unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
* [PATCH 0/2] libssh / libssh2 security updates
@ 2016-02-23 23:32 Leo Famulari
  2016-02-23 23:32 ` [PATCH 1/2] gnu: libssh2: Update to 1.7.0 Leo Famulari
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Leo Famulari @ 2016-02-23 23:32 UTC (permalink / raw)
  To: guix-devel

These patches address CVE-2016-0739 (libssh) and CVE-2016-0786 (libssh2)
[0].

For libssh, we update to the latest upstream release, 0.7.3.

Guile-ssh depends on a private package of an older version of libssh [1], so
we update that private package to the latest version supported by
guile-ssh, 0.6.5. This happens to be the previous version of our public
libssh package.

This allows us to remove the patch for CVE-2014-0017, which was fixed in
libssh-0.6.3 [2].

For libssh2, we update to the latest upstream release, 1.7.0.

Many packages depend on libssh2, including curl, so we create a
temporary package of the old, vulnerable version, 1.4. When we have
rebuilt all packages affected by CVE-2016-0786, this temporary package
should be removed and curl should be made to depend on the latest
version. That future commit should state "Fixes CVE-2016-7087".

Please double check that curl does not need to be rebuilt before
applying these patches. Feel free to reorganize them changes or alter
the commit messages as desired.

[0]
http://seclists.org/oss-sec/2016/q1/408
http://www.libssh.org/archive/libssh/2016-02/0000013.html
https://libssh2.org/changes.html

[1]
https://github.com/artyom-poptsov/guile-ssh#requirements

[2]
https://www.libssh.org/2014/03/04/libssh-0-6-3-security-release/
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0017


Leo Famulari (2):
  gnu: libssh2: Update to 1.7.0.
  gnu: libssh: Update to 0.7.3.

 gnu-system.am                                   |  1 -
 gnu/packages/curl.scm                           |  2 +-
 gnu/packages/patches/libssh-CVE-2014-0017.patch | 89 -------------------------
 gnu/packages/ssh.scm                            | 48 +++++++++----
 4 files changed, 35 insertions(+), 105 deletions(-)
 delete mode 100644 gnu/packages/patches/libssh-CVE-2014-0017.patch

-- 
2.7.1

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2016-02-23 23:37 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-23 23:32 [PATCH 0/2] libssh / libssh2 security updates Leo Famulari
2016-02-23 23:32 ` [PATCH 1/2] gnu: libssh2: Update to 1.7.0 Leo Famulari
2016-02-23 23:32 ` [PATCH 2/2] gnu: libssh: Update to 0.7.3 Leo Famulari
2016-02-23 23:37 ` [PATCH 0/2] libssh / libssh2 security updates Leo Famulari

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).