REDHAT-BUG-2332075: Medium severity Bzip2 bzip2 vulnerability

Published Dec 12, 2024

Updated

There were several "Security Fixes" for bzip2: out-of-bounds write in function BZ2decompress (CVE-2019-12900). e.g. RHSA-2024:8922 and RHSA-2024:10803.

The problem is that CVE-2019-12900 is 5 years old and bogus. The applied patch causes a change in behavior which causes some bz2 files to no longer decompress.

Upstream did a better fix for bzip2 1.0.8. Full story is here: https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/

You can see check that the new bzip2 is broken by running the upstream bzip2 testsuite:

$ git clone https://sourceware.org/git/bzip2-tests.git $ cd bzip2-tests $ ./run-tests.sh [...] bzip2: Data integrity error when decompressing. FAIL: ./lbzip2/32767.bz2 Decompress [...] Bad results, look for FAIL and !!! in the logs above - ./lbzip2/32767.bz2 bad decompress result

There should obviously be no FAILs.

Please revert this patch or apply the followup patch from 1.0.8: https://inbox.sourceware.org/bzip2-devel/f9230fc65a3529b59b31f13494c72a1c01a6148e.camel@klomp.org/ https://sourceware.org/cgit/bzip2/commit/?id=b07b105d1b66e32760095e3602261738443b9e13

Upstream reminder to Please don't "fix" CVE-2019-12900: https://inbox.sourceware.org/bzip2-devel/20241108214034.GC8315@gnu.wildebeest.org

Affected Software

1 affected component

Bzip2 bzip2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bzip2 to a version that resolves this vulnerability.
Fixed in 1.0.8

Event History

Dec 12, 2024

Data Sourced

via Red Hat·02:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2332075?

The severity of REDHAT-BUG-2332075 is classified as high due to an out-of-bounds write vulnerability in bzip2.

How do I fix REDHAT-BUG-2332075?

To fix REDHAT-BUG-2332075, update bzip2 to the latest patched version provided by your distribution.

What is the impact of REDHAT-BUG-2332075 on my system?

The impact of REDHAT-BUG-2332075 may allow an attacker to exploit an out-of-bounds write, potentially leading to arbitrary code execution.

Is my version of bzip2 affected by REDHAT-BUG-2332075?

You should check if your version of bzip2 is included in the list of affected versions related to REDHAT-BUG-2332075.

When was REDHAT-BUG-2332075 reported?

REDHAT-BUG-2332075 was reported in August 2019 detailing vulnerabilities in bzip2.