Patch for PwnKit

[ICIT2LOL]

I found this amongst my emails today https://www.techrepublic.com/article/pa ... r-systems/ and am wondering what to do about it.
Is it really a threat or not??

[kevin987]

I found this amongst my emails today https://www.techrepublic.com/article/pa ... r-systems/ and am wondering what to do about it.
Is it really a threat or not??

Please read this thread for possible solution:

viewtopic.php?f=47&t=366726

[zcot]

Yes, it is a real threat. The fix was pushed to the update manager already, just stay up-to-date.

[ICIT2LOL]

Ok thanks for the replies folks I will keep an eye out for the updates.

Edit now just how can I tell if the fix has been done on my machine??

[zcot]

Go into the Update Manager, check View menu -> History of updates.

find policykit-1, and there are a few other packages that are also with that. check the version. 0.105-26ubuntu1.1 to 0.105-26ubuntu1.2

check the changelog on that version: https://packages.ubuntu.com/search?keywords=policykit-1
check that page, pick your option, which is "focal" if you're on Mint 20.x., and you see on that page it is referencing the 1.2 package so you know what you're looking at,
now check that page on the right side for resources it will give you "changelog" which takes you there: http://changelogs.ubuntu.com/changelogs ... /changelog

in the changelog you see that most recent entry, and you see that date, yes, and you can copy/paste that CVE-2021-4034 into a search engine and know that this is it, even though that article you linked never gave the CVE number.

[smurphos]

Or just open a terminal and:

Check your installed version

Code: Select all

apt policy policykit-1

Check the change-log for the installed version

Code: Select all

apt changelog policykit-1

[JoeBachofen]

I checked my system as suggested and found: 2022-01-26 ... policykit-1 0.105-26ubuntu1.1 did go to 1.2
That was followed by a firefox update the next day; no further updates since then despite multiple tries.
Latest firefox and webkit2gtk updates fail in Update Manager as "Could not install the security update" not very helpful.
My problem is that Update Manager can no longer do updates and Synaptic won't even launch.
After reinstalling Synaptic, verifying 755 permissions throughout /usr/bin Update Manager is still NOP and Synaptic won't open.

Is anyone else having this problem?

[zcot]

Oh, nice smurfos, I wasn't aware of the changelog feature.

There's version also, I guess that's pretty direct. I was hung into the long winded, more about the idea, chasing out the data.

But I guess version and changelog is as direct as it needs to be.

[all41]

The mitigation update for polkit was available in all major Linux distos before the vulnerability was publicly known.
A good reason to check updates regularly. Security turns on a dime.
Before you even knew about the polkit vulnerability Mint team had your back