Bug 1174960

Well this Artha package has multiple problems:

- The release 1.0.5 only contains four new commits that have been made since
  the year 2014. None of the commits seems to deal with a buffer overflow or
  CVE-2018-18944, specifically.
- CVE-2018-18944 is quite unprecise. There's only a python script that creates
  a file containing 256 times the letter 'A'. Supposedly feeding this long
  string to Artha as a query string should crash it.
- When testing the current Artha devel package entering just "test" as a query
  causes a segmentation fault. So something is pretty wrong in there.


I don't see a big security issue from a buffer overflow here, because an
interactive user would need to enter a very strange long string into the
application to cause any severe harm. But still the package currently doesn't
seem to be stable.

Thanks, I see the instability too. Reported upstream, lets' wait and see what the app author says: <https://sourceforge.net/p/artha/news/2020/07/artha-105-released/#5fa1>

Actually, the unstable behaviour was tracked down to wordnet being compiled with link-time-optimization. This sr: <https://build.opensuse.org/request/show/830366> should do the trick. Since you think artha is ok security wise, I shall resubmit artha along with the wordnet fix to Factory. Hope that sounds ok. Thanks again for the review.

Please let us know when the SR# got accepted and the basic instability is out
of the way. Maybe we can then see something regarding this claimed buffer
overflow.

(In reply to Matthias Gerstner from comment #5)
> Please let us know when the SR# got accepted and the basic instability is out
> of the way. Maybe we can then see something regarding this claimed buffer
> overflow.

You may try it as of now from the Education repository. You will need both wordnet (specifically the pkg libWN3) and artha from there:

* https://build.opensuse.org/package/show/Education/artha
* https://build.opensuse.org/package/show/Education/wordnet

Thanks.

Using the new libWD the general instability is gone.

I can still not see what this CVE-2018-18944 is supposed to be. There's too
little in formation. The script found on vulnerabilitydb creates a file
containing a long string made up of 256 times the character 'A'.

Artha does not consume files as far as I can see. So the only thing that comes
to my mind is feeding the string into the query field. This does nothing bad.
I'd say this CVE can be disputed due to lack of reproducer and information.

I'm closing this bug as invalid. From the security point of view it should be
fine to add artha to Factory.

(In reply to Matthias Gerstner from comment #7)
> Using the new libWD the general instability is gone.
> 
> I can still not see what this CVE-2018-18944 is supposed to be. There's too
> little in formation. The script found on vulnerabilitydb creates a file
> containing a long string made up of 256 times the character 'A'.
> 
> Artha does not consume files as far as I can see. So the only thing that
> comes
> to my mind is feeding the string into the query field. This does nothing bad.
> I'd say this CVE can be disputed due to lack of reproducer and information.
> 
> I'm closing this bug as invalid. From the security point of view it should be
> fine to add artha to Factory.

Matthias, I can't thank you enough for your prompt responses about this and the good news your last comment brings :-)

This is an autogenerated message for OBS integration:
This bug (1174960) was mentioned in
https://build.opensuse.org/request/show/830781 Factory / artha