{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "- CVE-2018-10583 A LibreOffice document with a linked image, which is on a samba share, will cause LibreOffice to automatically initiate a samba connection to retrieve the image. This is by design. If end users or administrators wish to disable this functionality this can now be disabled via tools->options->security->options->block any links from documents not among the trusted locations.", "type": "security", "status": "stable", "request": null, "severity": "low", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2018-05-08 08:15:08", "date_modified": null, "date_approved": null, "date_testing": "2018-05-10 01:26:55", "date_stable": "2018-05-11 21:12:37", "alias": "FEDORA-2018-8d3f4d7b28", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2018-05-11 21:12:37", "meets_testing_requirements": true, "url": "https://bodhi.stg.fedoraproject.org/updates/FEDORA-2018-8d3f4d7b28", "title": "libreoffice-6.0.3.2-9.fc28", "version_hash": "52637fd39b8917f75a5b204a942e3ea098c4d921", "release": {"name": "F28", "long_name": "Fedora 28", "version": "28", "id_prefix": "FEDORA", "branch": "f28", "dist_tag": "f28", "stable_tag": "f28-updates", "testing_tag": "f28-updates-testing", "candidate_tag": "f28-updates-candidate", "pending_signing_tag": "f28-signing-pending", "pending_testing_tag": "f28-updates-testing-pending", "pending_stable_tag": "f28-updates-pending", "override_tag": "f28-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": null, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "caolanm", "email": "caolanm@redhat.com", "id": 248, "avatar": "https://seccdn.libravatar.org/avatar/f519d697bbf022cfaa653496647699de66b59f77508964d17c6338788db25e26?s=24&d=retro", "openid": "caolanm.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}, {"name": "svnooo-diafilter"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by caolanm. ", "timestamp": "2018-05-08 08:15:08", "update_id": 114900, "user_id": 91, "id": 780652, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "works", "timestamp": "2018-05-08 11:01:31", "update_id": 114900, "user_id": 3025, "id": 780691, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "danniel", "email": "daniellarasouza@yahoo.com.br", "id": 3025, "avatar": "https://seccdn.libravatar.org/avatar/88ab711305bc0f0168945ac5782b8eebcbcd33eb7cdac2a793465b5741b087f8?s=24&d=retro", "openid": "danniel.id.stg.fedoraproject.org", "groups": [{"name": "packager"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Shouldn't it be opt-in by default? And maybe some notification with question weather user want to allow LibreOffice to try to connect to remote samba share?\n\nIt seems that this feature (document with attachment on remote share) will more likely be used by an attacker than users.", "timestamp": "2018-05-08 12:36:22", "update_id": 114900, "user_id": 3674, "id": 780740, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "ozeszty", "email": "ozeszty@gmail.com", "id": 3674, "avatar": "https://seccdn.libravatar.org/avatar/9aeace02fa2d54f1f5febd3460182261a6a518035ea75cc9d788240d6e669cbe?s=24&d=retro", "openid": "ozeszty.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Wrt notification, right now there is no such notification ui so its not practical to provide one in a timely manner, though some form of infobar notification would be a good idea. Wrt opt in/out out, what we have available is an opt-in/out-out for *all* links, smb, http, https etc. So opening any html with graphic  links in them would auto-fail which is a bit radical, especially in the absence of a ui to explain and rectify it. ", "timestamp": "2018-05-08 13:13:07", "update_id": 114900, "user_id": 248, "id": 780760, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "caolanm", "email": "caolanm@redhat.com", "id": 248, "avatar": "https://seccdn.libravatar.org/avatar/f519d697bbf022cfaa653496647699de66b59f77508964d17c6338788db25e26?s=24&d=retro", "openid": "caolanm.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}, {"name": "svnooo-diafilter"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Thanks for your answer. Infobar notification is what I've already seen in action and had in mind, just didn't know the official name. Would infobar notification only for SMB links saying 'An image from SMB share (smb://... or file://...) was blocked. If you're sure it's not a rogue SMB server, **unlock it**' be feasible?", "timestamp": "2018-05-09 07:48:30", "update_id": 114900, "user_id": 3674, "id": 780958, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "ozeszty", "email": "ozeszty@gmail.com", "id": 3674, "avatar": "https://seccdn.libravatar.org/avatar/9aeace02fa2d54f1f5febd3460182261a6a518035ea75cc9d788240d6e669cbe?s=24&d=retro", "openid": "ozeszty.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}, {"karma": 0, "karma_critpath": 0, "text": "Not right now. Eventually maybe. But wrt smb, there's nothing special about them vs say http/https from LibreOffice's perspective so its a general remote links issue rather than a specific smb links issue.", "timestamp": "2018-05-09 07:57:02", "update_id": 114900, "user_id": 248, "id": 780960, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "caolanm", "email": "caolanm@redhat.com", "id": 248, "avatar": "https://seccdn.libravatar.org/avatar/f519d697bbf022cfaa653496647699de66b59f77508964d17c6338788db25e26?s=24&d=retro", "openid": "caolanm.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "cla_redhat"}, {"name": "svnooo-diafilter"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2018-05-10 01:32:12", "update_id": 114900, "user_id": 91, "id": 781418, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "No regressions here.", "timestamp": "2018-05-10 02:48:08", "update_id": 114900, "user_id": 198, "id": 781494, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bojan", "email": "bojan@rexursive.com", "id": 198, "avatar": "https://seccdn.libravatar.org/avatar/adb4c3f28bd6969871988f992b1bf71e404f03e3570fbfa0fc9bd7d0bf0003f8?s=24&d=retro", "openid": "bojan.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}}, {"karma": 1, "karma_critpath": 0, "text": "Works great!  LGTM!  =)", "timestamp": "2018-05-10 09:00:07", "update_id": 114900, "user_id": 206, "id": 781695, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "besser82", "email": "besser82.fpo@gmail.com", "id": 206, "avatar": "https://seccdn.libravatar.org/avatar/28bacfa3be75032390ac2c7a34599aeb825c3b62b2c55ef64821d2fc023b56cb?s=24&d=retro", "openid": "besser82.id.stg.fedoraproject.org", "groups": [{"name": "proventesters"}, {"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "ambassadors"}, {"name": "designteam"}, {"name": "shogun-ca"}, {"name": "alt-gtk-de-sig"}, {"name": "trust admins"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for batched by bodhi. ", "timestamp": "2018-05-10 09:00:07", "update_id": 114900, "user_id": 91, "id": 781696, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2018-05-10 13:24:58", "update_id": 114900, "user_id": 2935, "id": 781865, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "imabug", "email": "eugenemah@gmail.com", "id": 2935, "avatar": "https://seccdn.libravatar.org/avatar/ea8ba927783ee0ef10e6f05f14791abf925972bac4f31aba458058d3e7907a6d?s=24&d=retro", "openid": "imabug.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedora-hams"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2018-05-11 03:00:56", "update_id": 114900, "user_id": 91, "id": 782510, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "CVE-2018-10583 seems to be what makes smb links different from http, I think, because for smb the linked file doesn't need to be malicious for attack to succeed - it just exploits default behaviour and is easy to prepare.\n\nNo regressions noted with this update.", "timestamp": "2018-05-11 08:00:20", "update_id": 114900, "user_id": 3674, "id": 782588, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "ozeszty", "email": "ozeszty@gmail.com", "id": 3674, "avatar": "https://seccdn.libravatar.org/avatar/9aeace02fa2d54f1f5febd3460182261a6a518035ea75cc9d788240d6e669cbe?s=24&d=retro", "openid": "ozeszty.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2018-05-11 21:14:38", "update_id": 114900, "user_id": 91, "id": 782923, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "libreoffice-6.0.3.2-9.fc28", "signed": true, "release_id": 21, "type": "rpm", "epoch": 1}], "bugs": [{"bug_id": 1575000, "title": "CVE-2018-10583 libreoffice: Information disclosure via SMB connection embedded in malicious file [fedora-all]", "security": true, "parent": false, "feedback": []}], "updateid": "FEDORA-2018-8d3f4d7b28", "karma": 5, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}