Test ID:	1.3.6.1.4.1.25623.1.0.827746
Category:	Fedora Local Security Checks
Title:	Fedora: Security Advisory for mirrorlist-server (FEDORA-2023-37ae269843)
Summary:	The remote host is missing an update for the 'mirrorlist-server'; package(s) announced via the FEDORA-2023-37ae269843 advisory.
Description:	Summary: The remote host is missing an update for the 'mirrorlist-server' package(s) announced via the FEDORA-2023-37ae269843 advisory. Vulnerability Insight: The mirrorlist-server uses the data created by MirrorManager2 to answer client request for the 'best' mirror. This implementation of the mirrorlist-server is written in Rust. The original version of the mirrorlist-server was part of the MirrorManager2 repository and it is implemented using Python. While moving from Python2 to Python3 one of the problems was that the data exchange format (Python Pickle) did not support running the MirrorManager2 backend with Python2 and the mirrorlist frontend with Python3. To have a Pickle independent data exchange format protobuf was introduced. The first try to use protobuf in the python mirrorlist implementation required a lot more memory than the Pickle based implementation (3.5GB instead of 1.1GB). That is one of the reasons a new mirrorlist-server implementation was needed. Another reason to rewrite the mirrorlist-server is its architecture. The Python based version requires the Apache HTTP server or something that can run the included wsgi. The wsgi talks over a socket to the actual mirrorlist-server. In Fedora', s MirrorManager2 instance this runs in a container which runs behind HAProxy. This implementation in Rust directly uses a HTTP library to reduce the number of involved components. In addition to being simpler this implementation also requires less memory than the Python version. Affected Software/OS: 'mirrorlist-server' package(s) on Fedora 37. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-26964 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHBAE7LQARMPUEEV4TWET4D7G6WCWBUD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYRZ5Y2ALATKKPIITAFAJIS4TR4LUAHO/ https://github.com/hyperium/hyper/issues/2877
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.