Vulnerability Roundup 28 #30959

ckauhaus · 2017-10-30T11:23:05Z

grahamc · 2017-10-30T11:24:34Z

🚨 ⚡️ 👍 🔥 🚒 🎆 🙌 📯 😄 😂 😹 :partyparrot:

grahamc · 2017-10-30T11:25:47Z

cc: @LnL7 @7c6f434c @fpletz @globin @NeQuissimus @wizeman @FRidh @vcunat @peterhoeg @ndowens @dezgeg @nh2.

Note: The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg
@NixOS/security-notifications

If you would like to be CC'd on all roundups, PM me.

ckauhaus · 2017-10-30T11:28:16Z

This list needs manual cleanup since vulnix does not honour CVE patches already present. Working on this.

disassembler · 2017-10-30T11:31:07Z

I'm looking at freetype.

disassembler · 2017-10-30T11:31:47Z

freetype-2.7.1 (search, files) (CVE-2017-8105) is already patched.

dezgeg · 2017-10-30T11:34:31Z

Sqlite needs merging #30927 AFAICT.

disassembler · 2017-10-30T11:38:30Z

#21161 Should resolved jquery-ui CVE.

disassembler · 2017-10-30T11:40:34Z

libxslt is already patched in master and 17.09.

disassembler · 2017-10-30T11:41:59Z

I'll take libjpeg-turbo

fpletz · 2017-10-30T12:02:10Z

libvorbis

CVE-2017-11333
- No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2332
- Only a DoS, Debian considers this a minor issue https://security-tracker.debian.org/tracker/CVE-2017-11333
CVE-2017-14160
- No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2330
CVE-2017-14632
- No upstream fix yet (RCE vul)call oggpack_writeclear() with uninitialized stack var opb in function vorbis_analysis_headerout() when vi->channels<=0 in libvorbis 1.3.5 xiph/vorbis#29
CVE-2017-14633
- No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2329

fpletz · 2017-10-30T12:09:42Z

The openldap CVE-2017-14159 is a minor issue with PID file creation. It is only really applicable if initscripts are used, so NixOS isn't even vulnerable since our openldap service neither uses nor creates a PID file. Ticked off.

NeQuissimus · 2017-10-30T12:33:25Z

All the audiofile stuff seems to be mpruett/audiofile#42

pbogdan · 2017-10-30T12:48:36Z

sqlite - staging is already on 3.20.1 but that suffers from CVE-2017-15286, a PR is opened to update to 3.21.0 #30927

pbogdan · 2017-10-30T13:11:50Z

libtiff - we have patches for:

CVE-2017-9937 - appears to be a incorrectly assigned, the bug is in jbigkit package - http://bugzilla.maptools.org/show_bug.cgi?id=2707

7c6f434c · 2017-10-30T13:58:08Z

libtasn1: source reports fixing CVE-2017-9310 with an upstream patch; in reality it seems to be a patch for CVE-2017-10790. It seems that https://nvd.nist.gov/vuln/detail/CVE-2017-9310 is about Qemu anyway… It seems that Debian imported the same patch http://git.savannah.nongnu.org/cgit/libtasn1.git/patch/?id=d8d805e1f2e6799bb2dff4871a8598dc83088a39 as a fix for CVE-2017-10790 in
https://anonscm.debian.org/cgit/pkg-gnutls/libtasn1.git/commit/?id=75d2ac4bcc8c92515d1bbda33103c5f78d353a6e

Could anyone recheck that I am not missing something?

Edited to add: and, of course, renaming the patch will be a gtk-rebuild…

adisbladis · 2017-10-30T18:21:11Z

CVE-2017-14166 and CVE-2017-14502 (libarchive) fixed in #30990.

The other two (CVE-2017-14503 and CVE-2017-14166) has no upstream patches yet.

peterhoeg · 2017-10-31T04:05:28Z

The following openjpeg CVEs are already fixed in master and 17.09 ref 428927f :

So I'm marking those.

flokli · 2017-11-01T11:24:01Z

Actually, CVE-2017-10790 got fixed in 1fb803c (although pretending to have fixed CVE-2017-9310), so this can be checked too.

I added a commit in #31082 fixing the CVE number.

flokli · 2017-11-01T14:11:09Z

jython fix comes with #31090.

vcunat · 2017-11-01T15:45:02Z

I've got bad news for nixos-unstable* channels.

-small jobset has succeeded hours ago, but apparently the channel script is stuck. The big jobset is blocked by one test that seems impossible to start, even if I cancel and restart it. /cc @edolstra

EDIT: nixos-unstable updated now and should be OK, whereas -small keeps stuck, paradoxically.

vcunat · 2017-11-01T19:16:32Z

I picked this round of mass rebuilds to 17.09. In case of e.g. sqlite it may have been more suitable to find and apply only specific patches instead of the upgrades; certainly feel free to do so (I don't have that much time to spare).

vcunat · 2017-11-01T19:21:40Z

And speaking of time, I ignored 17.03, at least for now. IIRC we used to leave only a month's overlay, so we might just drop picking to 17.03 except for really critical problems. I really have no idea how fast NixOS users migrate, but one month probably isn't too much. I believe we should at least explicitly announce such plans in advance, saying e.g. that 17.09 shall be maintained (at least) until the end of May 2018.

fpletz · 2017-11-01T19:26:59Z

I was also just about to also push those cherry-picks after having tested a few builds. Thanks! I'm more liberal concerning minor package bumps if they don't break any of our packages.

Regarding the security support: I agree but let's wait until we have the security team and 'on call' figured out. I'll also try to fix the most important ones for 17.03.

adisbladis · 2017-11-02T01:55:55Z

All of theowcloud vulnerabilities are fixed after version 8.1.2.

@matejc Is there any reason to keep so many old versions around?

vcunat · 2017-11-05T10:33:57Z

We have a libc problem: https://nvd.nist.gov/vuln/detail/CVE-2017-15670

Plan:

pick just the patch for 17.09, and verify there aren't more missed security patches; EDIT: 6566d0a
on staging update to 2.26+stable directly, and get to nixos-unstable* soon

grahamc · 2017-11-05T10:38:54Z

Sounds good, vcunat. Other distro bug trackers and source repos can prove helpful to enumerate security patches we may need.

…

On Sun 5. Nov 2017 at 11:34, Vladimír Čunát ***@***.***> wrote: We have a libc problem: https://nvd.nist.gov/vuln/detail/CVE-2017-15670 Plan: - pick just the patch for 17.09, and verify there aren't more missed security patches - on staging update to 2.26+stable directly, and get to nixos-unstable* soon — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#30959 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAErrERBLoO3LiLVuJcyBM19bh7cuhxRks5szY8ZgaJpZM4QLB8y> .

vcunat · 2017-11-07T15:16:02Z

glibc: on 17.09 it's in channels (probably), and we have it on master as well, with some caveats: 6ffafc7.

Fixes: * CVE-2017-6827 * CVE-2017-6828 * CVE-2017-6829 * CVE-2017-6830 * CVE-2017-6831 * CVE-2017-6832 * CVE-2017-6833 * CVE-2017-6834 * CVE-2017-6835 * CVE-2017-6836 * CVE-2017-6837 * CVE-2017-6838 * CVE-2017-6839 cc #30959 (cherry picked from commit a6044ad)

fpletz · 2017-11-19T17:30:16Z

Patched the audiofile issues.

Fixes: * CVE-2017-6827 * CVE-2017-6828 * CVE-2017-6829 * CVE-2017-6830 * CVE-2017-6831 * CVE-2017-6832 * CVE-2017-6833 * CVE-2017-6834 * CVE-2017-6835 * CVE-2017-6836 * CVE-2017-6837 * CVE-2017-6838 * CVE-2017-6839 cc #30959

Fixes the patches names for security tools to parse CVEs. Adds patch to fix CVE-2017-14634. cc #30959

cc #30959

Fixes CVE-2014-9450, CVE-2016-4338. cc #30959

Fixes the patches names for security tools to parse CVEs. Adds patch to fix CVE-2017-14634. cc #30959 (cherry picked from commit 58218d4)

cc #30959 (cherry picked from commit 439fc35)

Fixes CVE-2014-9450, CVE-2016-4338. cc #30959 (cherry picked from commit 1d66d64)

Fixes: * CVE-2016-10504 * CVE-2016-10505 * CVE-2016-10506 * CVE-2016-10507 * CVE-2016-9112 * CVE-2016-9113 * CVE-2016-9114 * CVE-2016-9115 * CVE-2016-9116 * CVE-2016-9117 * CVE-2016-9118 cc NixOS#30959

Fixes: * CVE-2016-10504 * CVE-2016-10505 * CVE-2016-10506 * CVE-2016-10507 * CVE-2016-9112 * CVE-2016-9113 * CVE-2016-9114 * CVE-2016-9115 * CVE-2016-9116 * CVE-2016-9117 * CVE-2016-9118 cc #30959 (cherry picked from commit 4e57256)

fpletz · 2017-11-19T18:37:41Z

Fixed all remaining fixable CVEs and added comments to the remaining issues. Most can't be fixed because there is no upstream fix yet. I think we can close this issue now and do another roundup soon.

disassembler mentioned this issue Oct 30, 2017

pcre: 8.40 -> 8.41 (fixes multiple CVEs) #30963

Closed

8 tasks

NeQuissimus mentioned this issue Oct 30, 2017

cyrus_sasl: Fix CVE-2013-4122 #30964

Closed

8 tasks

NeQuissimus mentioned this issue Oct 30, 2017

perl: 5.24.2 -> 5.24.3 #30965

Merged

8 tasks

This was referenced Oct 30, 2017

owncloud-7.0.5: multiple CVEs #31000

Closed

jython-2.7.0 - CVE-2016-4000 #30999

Closed

zabbix-2.0.11: multiple CVEs #30997

Closed

fpletz added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Nov 1, 2017

fpletz added the 9.needs: port to stable A PR needs a backport to the stable release. label Nov 1, 2017

fpletz added a commit that referenced this issue Nov 19, 2017

libsndfile: add patches for multiple CVEs

58218d4

Fixes the patches names for security tools to parse CVEs. Adds patch to fix CVE-2017-14634. cc #30959

fpletz added a commit that referenced this issue Nov 19, 2017

owncloud705: remove vulnerable version

439fc35

cc #30959

fpletz added a commit that referenced this issue Nov 19, 2017

zabbix20: 2.0.11 -> 2.0.21 for multiple CVEs

1d66d64

Fixes CVE-2014-9450, CVE-2016-4338. cc #30959

fpletz added a commit that referenced this issue Nov 19, 2017

libsndfile: add patches for multiple CVEs

c4ff51e

Fixes the patches names for security tools to parse CVEs. Adds patch to fix CVE-2017-14634. cc #30959 (cherry picked from commit 58218d4)

fpletz added a commit that referenced this issue Nov 19, 2017

owncloud705: remove vulnerable version

e728baf

cc #30959 (cherry picked from commit 439fc35)

fpletz added a commit that referenced this issue Nov 19, 2017

zabbix20: 2.0.11 -> 2.0.21 for multiple CVEs

26118d2

Fixes CVE-2014-9450, CVE-2016-4338. cc #30959 (cherry picked from commit 1d66d64)

fpletz closed this as completed Nov 19, 2017

fpletz removed the 9.needs: port to stable A PR needs a backport to the stable release. label Nov 19, 2017

ckauhaus mentioned this issue Nov 27, 2017

Vulnerability Roundup 29 #32117

Closed

17 tasks

adisbladis mentioned this issue Jan 13, 2018

Vulnerabilty Roundup 32 #33826

Closed

38 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vulnerability Roundup 28 #30959

Vulnerability Roundup 28 #30959

ckauhaus commented Oct 30, 2017 •

edited by fpletz

Loading

grahamc commented Oct 30, 2017 •

edited

Loading

grahamc commented Oct 30, 2017

ckauhaus commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

dezgeg commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

fpletz commented Oct 30, 2017

fpletz commented Oct 30, 2017

NeQuissimus commented Oct 30, 2017

pbogdan commented Oct 30, 2017

pbogdan commented Oct 30, 2017

7c6f434c commented Oct 30, 2017 •

edited

Loading

adisbladis commented Oct 30, 2017 •

edited

Loading

peterhoeg commented Oct 31, 2017

flokli commented Nov 1, 2017 •

edited by NeQuissimus

Loading

flokli commented Nov 1, 2017

vcunat commented Nov 1, 2017 •

edited

Loading

vcunat commented Nov 1, 2017

vcunat commented Nov 1, 2017

fpletz commented Nov 1, 2017

adisbladis commented Nov 2, 2017

vcunat commented Nov 5, 2017 •

edited

Loading

grahamc commented Nov 5, 2017 via email

vcunat commented Nov 7, 2017

fpletz commented Nov 19, 2017

fpletz commented Nov 19, 2017

Vulnerability Roundup 28 #30959

Vulnerability Roundup 28 #30959

Comments

ckauhaus commented Oct 30, 2017 • edited by fpletz Loading

audiofile-0.3.6 (search, files)

cyrus-sasl-2.1.26 (search, files)

freetype-2.7.1 (search, files)

jquery-ui-1.11.4 (search, files)

libarchive-3.3.2 (search, files)

libjpeg-turbo-1.5.2 (search, files)

libsndfile-1.0.28 (search, files)

libtasn1-4.12 (search, files)

libtiff-4.0.8 (search, files)

libvorbis-1.3.5 (search, files)

libxslt-1.1.29 (search, files)

openjpeg-2.1.2 (search, files)

openldap-2.4.45 (search, files)

pcre-8.40 (search, files)

perl-5.24.2 (search, files)

sqlite-3.20.0 (search, files)

owncloud-7.0.5 (search, files)

jython-2.7.0 (search, files)

zabbix-2.0.11 (search, files)

grahamc commented Oct 30, 2017 • edited Loading

grahamc commented Oct 30, 2017

ckauhaus commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

dezgeg commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

disassembler commented Oct 30, 2017

fpletz commented Oct 30, 2017

libvorbis

fpletz commented Oct 30, 2017

NeQuissimus commented Oct 30, 2017

pbogdan commented Oct 30, 2017

pbogdan commented Oct 30, 2017

7c6f434c commented Oct 30, 2017 • edited Loading

adisbladis commented Oct 30, 2017 • edited Loading

peterhoeg commented Oct 31, 2017

flokli commented Nov 1, 2017 • edited by NeQuissimus Loading

flokli commented Nov 1, 2017

vcunat commented Nov 1, 2017 • edited Loading

vcunat commented Nov 1, 2017

vcunat commented Nov 1, 2017

fpletz commented Nov 1, 2017

adisbladis commented Nov 2, 2017

vcunat commented Nov 5, 2017 • edited Loading

grahamc commented Nov 5, 2017 via email

vcunat commented Nov 7, 2017

fpletz commented Nov 19, 2017

fpletz commented Nov 19, 2017

ckauhaus commented Oct 30, 2017 •

edited by fpletz

Loading

grahamc commented Oct 30, 2017 •

edited

Loading

7c6f434c commented Oct 30, 2017 •

edited

Loading

adisbladis commented Oct 30, 2017 •

edited

Loading

flokli commented Nov 1, 2017 •

edited by NeQuissimus

Loading

vcunat commented Nov 1, 2017 •

edited

Loading

vcunat commented Nov 5, 2017 •

edited

Loading