Ubuntu
ubuntu-advantage-tools package

  1. Bionic (18.04)
  2. Bug #1926183
  3. Comment #0

Comment 0 for bug 1926183

Revision history for this message
James Troup (elmo) wrote :

root@malefic:~# ua fix CVE-2021-3410
CVE-2021-3410: libcaca vulnerability
https://ubuntu.com/security/CVE-2021-3410
1 affected package is installed: libcaca
(1/1) libcaca:
A fix is available in Ubuntu standard updates.
The update is already installed.
A reboot is required to complete fix operation.
✘ CVE-2021-3410 is not resolved.
root@malefic:~#

The line 'A reboot is required to complete fix operation.' may be partially true (i.e. a reboot is needed) for other reasons, but is not accurate in the context of this CVE. Both 'checkrestart' and 'needrestart' confirm that no running process is using the caca library. Looking at the code, it looks like it's looking at a global 'needs reboot' flag, unrelated to the specific fix operation. I'd argue that a) it shouldn't say 'to complete fix operation' and b) it shouldn't claim 'CVE-2021-3410 is not resolved'.