MGASA-2023-0005 - Updated minetest packages fix security vulnerability

Publication date: 13 Jan 2023
URL: https://advisories.mageia.org/MGASA-2023-0005.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-35978

This update provides minetest 5.6.1, the latest stable release of the open
source voxel game. This updates provides a number of feature and bug fix
changes compared to the previous version 5.4.0 provided in Mageia 8. See
the linked release notes and changelogs for details.

The update also improves compatibility with hosted game servers, which
typically run and expect the latest stable release.

The update also fixes a security vulnerability affecting single player
with malicious mods (GHSA-663q-pcjw-27cc)

In single player, a mod could set a global setting that controls the Lua
script loaded to display the main menu. The script would be loaded as soon
as the game session is exited. The Lua environment the menu runs in was
not sandboxed and could directly  interfere with the user's system.
(CVE-2022-35978)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31363
- https://blog.minetest.net/2022/08/04/5.6.0-released/
- https://dev.minetest.net/Changelog#5.4.0_.E2.86.92_5.5.0
- https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0
- https://dev.minetest.net/Changelog#5.6.0_.E2.86.92_5.6.1
- https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35978

SRPMS:
- 8/core/minetest-5.6.1-1.mga8