Score:0

Ubuntu

Ubuntu package:libcaca security vulnerability (CVE-2021-30498, CVE-2021-30499)

v-lan

2/21/23, 4:32 PM

I'm using Ubuntu 20.04.3 LTS (focal) with XFCE DE, on a AMD 64-bit machine. When I did apt upgrade today, the package: libcaca0 was upgraded as below:

Unpacking **libcaca0:amd64 (0.99.beta19-2.1ubuntu1.20.04.2)** over **(0.99.beta19-2.1ubuntu1.20.04.1)**

I just googled out of curiosity to see what this package does & encountered this page: https://ubuntu.com/security/notices/USN-5119-1

It says that there is a known security vulnerability in this package & need to be upgraded to: libcaca0 - 0.99.beta19-2.2ubuntu2.1, in order to mitigate it. However, as you can see, apt only upgrades to the version 19-2.1.

I tried to upgrade the particular package only, using

sudo apt-get --only-upgrade install libcaca0

but, it says libcaca0 is already the newest version (0.99.beta19-2.1ubuntu1.20.04.2)..

This page says that there's no fix available till 2021-10-13: https://ubuntu.com/security/CVE-2021-30499

However, as per this page, ver: 19.2.2 has been released on 2021-03-20. https://launchpad.net/debian/+source/libcaca/0.99.beta19-2.2

And, the download seems to be available at: https://launchpad.net/ubuntu/+source/libcaca/0.99.beta19-2.2ubuntu1.1

(I noticed that the release confirmation page belongs to Debian, while the download page points to Ubuntu. I believe, both the release & download pages will be available for both distros. So, the question is not about that.)

My question

If the package version is available for download (for Ubuntu)? Why apt couldn't upgrade to it? Is it because of some approval pending? If so, why there's a download available?

My intention is not to complain, but rather to scrutinize/understand the generic process/reason & what to do in this/these kind of situations - like:

whether to download the available tar & install, or to wait for apt version to be available,
shouldn't the users be notified of such issues (esp. on security vulnerabilities), or is it not possible at all,
if the package has a vulnerability, why even the apt upgrade recommends it (and, is it not possible to remove it until a fix is available - of course, provided an alternative package is available to meet other dependencies)
etc.

And, if possible, some expert notes on the technicalities of the vulnerability, how/why it is caused, etc [I know.. I should look it up myself.. but, still! :) ]. Even though I'm using it for quite sometime now, I'm relatively new to Linux & not yet even a core user - leave alone a contributor.

120

0 + 0

upgrade

package-management

security

vulnerability

20.04

Score:3

Ubuntu

Pilot6

2/21/23, 4:44 PM

You didn't read your link carefully.

https://ubuntu.com/security/notices/USN-5119-1

Ubuntu 20.04

caca-utils - 0.99.beta19-2.1ubuntu1.20.04.2
libcaca0 - 0.99.beta19-2.1ubuntu1.20.04.2

So you got the correct update. You have the fix installed already. No action is required.

libcaca0 - 0.99.beta19-2.2ubuntu2.1 is for Ubuntu 21.10.

0 + 0

v-lan

2/21/23, 4:58 PM

Yes, you are right. I missed it.. but, what do you mean by 'rot'? So, should I delete the question or something? By the way, the vulnerability still applies to 20.04 too, right? If so, my other questions remain relevant, isn't it?

Pilot6

2/21/23, 5:00 PM

It was a typo. I meant "got".

Pilot6

2/21/23, 5:00 PM

The vulnerability has been fixed for 20.02 and you already have it fixed. So what is the problem?

Pilot6

2/21/23, 5:02 PM

"Why download is available" isn't an issue. Do you need any more explanation?

v-lan

2/21/23, 5:27 PM

No.. unless, you have some more detailed information on what this vulnerability is about. Also, I still have the question, as a user, I was still using the package till this time & I had no idea that there is such a vulnerability (whether I'd have done something about it, is a question, but still). And, while reading about this, I came across some other vulnerabilities too. I'm just wondering if there's a way to keep informed on such stuff. Anyway, I'm going to delete this question, as it is misleading/mis-informing. Thanks for your time.

Pilot6

2/21/23, 5:32 PM

Don't delete the question. It is not a bad one. I have no information on this specific issue. But there are a lot of places where you can track vulnerabilities. But they are fixed fast enough. So keeping your system updated is enough in most of the cases.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Ubuntu package:libcaca security vulnerability (CVE-2021-30498, CVE-2021-30499)

TH: แพ็คเกจ Ubuntu: ช่องโหว่ความปลอดภัย libcaca (CVE-2021-30498, CVE-2021-30499)

RO: Pachetul Ubuntu: vulnerabilitate de securitate libcaca (CVE-2021-30498, CVE-2021-30499)

RU: Пакет Ubuntu: уязвимость безопасности libcaca (CVE-2021-30498, CVE-2021-30499)

VI: Gói Ubuntu:lỗ hổng bảo mật libcaca (CVE-2021-30498, CVE-2021-30499)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.