openssh vulnerability

openssh vulnerability

[Christopher Lemmer Webber]

https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

seems serious?

Re: openssh vulnerability

[Mike Gerwitz]

[-- Attachment #1: Type: text/plain, Size: 425 bytes --]

On Tue, Oct 16, 2018 at 21:20:30 -0400, Christopher Lemmer Webber wrote:
> https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
>
> seems serious?

Very... Fortunately that's libssh and not OpenSSH[0], but with that said,
it does appear to be packaged in Guix and there are a couple packages
that use it.


[0]: You had me very worried from your subject line!

-- 
Mike Gerwitz

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: openssh vulnerability

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 466 bytes --]

On Wed, Oct 17, 2018 at 12:47:26AM -0400, Mike Gerwitz wrote:
> On Tue, Oct 16, 2018 at 21:20:30 -0400, Christopher Lemmer Webber wrote:
> > https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
> >
> > seems serious?
> 
> Very... Fortunately that's libssh and not OpenSSH[0], but with that said,
> it does appear to be packaged in Guix and there are a couple packages
> that use it.

Patch at <https://bugs.gnu.org/33067>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: openssh vulnerability

[Christopher Lemmer Webber]

Leo Famulari writes:

> On Wed, Oct 17, 2018 at 12:47:26AM -0400, Mike Gerwitz wrote:
>> On Tue, Oct 16, 2018 at 21:20:30 -0400, Christopher Lemmer Webber wrote:
>> > https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
>> >
>> > seems serious?
>> 
>> Very... Fortunately that's libssh and not OpenSSH[0], but with that said,
>> it does appear to be packaged in Guix and there are a couple packages
>> that use it.

Ha, sorry for the scare.

> Patch at <https://bugs.gnu.org/33067>

Yay, thanks Leo!

Re: openssh vulnerability

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1250 bytes --]

Christopher Lemmer Webber <cwebber@dustycloud.org> writes:

> Leo Famulari writes:
>
>> [...]
>>
>> Patch at <https://bugs.gnu.org/33067>
>
> Yay, thanks Leo!

Thank you for the fix!  It looks like this change
(eed00f93e8999712191e39c59c15e23461520f43) went to master:

--8<---------------cut here---------------start------------->8---
$ git branch -a --contains eed00f93e8999712191e39c59c15e23461520f43
* (HEAD detached at 7d1f21c69)
  master
  remotes/origin/HEAD -> origin/master
  remotes/origin/master
  remotes/origin/wip-next-browser3
--8<---------------cut here---------------end--------------->8---


Will this change trigger many rebuilds?  It has many dependents:

--8<---------------cut here---------------start------------->8---
$ guix refresh -l libssh2
Building the following 1321 packages would ensure 3307 dependent
packages are rebuilt: [...]
--8<---------------cut here---------------end--------------->8---

I looked into this email thread mainly because I was curious to see how
we would apply the security update.  I thought we would use grafts
somehow, but this looks like we just changed the package definition on
master, which will result in more rebuilds than usual - right?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

libssh vulnerability

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

On Sat, Oct 20, 2018 at 01:17:48PM -0700, Chris Marusich wrote:
> Will this change trigger many rebuilds?  It has many dependents:
> 
> --8<---------------cut here---------------start------------->8---
> $ guix refresh -l libssh2
> Building the following 1321 packages would ensure 3307 dependent
> packages are rebuilt: [...]
> --8<---------------cut here---------------end--------------->8---

It's true that libssh2 has too many dependents to update without a
graft. However, libssh, which is what was changed, only has a handful of
dependents, which is convenient for us :)

------
$ guix refresh -l libssh
Building the following 9 packages would ensure 12 dependent packages are rebuilt: kodi@18.0_alpha-8.ec16dbc wireshark@2.6.4 guile2.0-guix@0.15.0-5.1d0be47 cuirass@0.0.1-20.fe2b73c emacs-guix@0.5 gwl@0.1.1 hpcguix-web@0.0.1-3.53e09ea guile2.2-ssh@0.11.3 tmate@2.2.1
------

It's confusing, but libssh and libssh2 are totally separate projects.
And for the record, they are also not related to OpenSSH, which is the
one we all know and use directly.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: libssh vulnerability

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 355 bytes --]

Leo Famulari <leo@famulari.name> writes:

> It's true that libssh2 has too many dependents to update without a
> graft. However, libssh, which is what was changed, only has a handful of
> dependents, which is convenient for us :)

Oh, I see - I was confused and incorrectly thought you had updated
libssh2.  Sorry for the confusion!

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]