From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: 01/01: gnu: curl: Update replacement to 7.51.0 [fixes CVE-2016-{8615..8625}]. Date: Thu, 3 Nov 2016 00:03:25 -0400 Message-ID: <20161103040325.GA11784@jasmine> References: <20161102120226.4648.97843@vcs.savannah.gnu.org> <20161102120227.14695220063@vcs.savannah.gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="0F1p//8PRICkK4MW" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:43842) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c29FT-0001pL-9n for guix-devel@gnu.org; Thu, 03 Nov 2016 00:03:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c29FQ-0002Wz-5B for guix-devel@gnu.org; Thu, 03 Nov 2016 00:03:31 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:40547) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c29FQ-0002Ws-1Q for guix-devel@gnu.org; Thu, 03 Nov 2016 00:03:28 -0400 Received: from localhost (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id D9704F29CC for ; Thu, 3 Nov 2016 00:03:26 -0400 (EDT) Content-Disposition: inline In-Reply-To: <20161102120227.14695220063@vcs.savannah.gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org --0F1p//8PRICkK4MW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Nov 02, 2016 at 12:02:27PM +0000, Marius Bakke wrote: > commit cbf5889fe542dafe71c6eedf9cc72673495fcc88 > Author: Marius Bakke > Date: Wed Nov 2 09:01:36 2016 +0000 >=20 > gnu: curl: Update replacement to 7.51.0 [fixes CVE-2016-{8615..8625}]. > =20 > * gnu/packages/curl.scm (curl)[replacement]: Update to 7.51.0. > (curl-7.50.3): Replace with ... > (curl-7.51.0): ... this. It turns out that with 7.50.1, curl changed their provider of internationalized domain name support from libidn to libidn2, which we don't have a package for yet. You can see the change in this standalone patch for CVE-2016-8625: https://curl.haxx.se/docs/adv_20161102K.html And here Daniel Stenberg, the curl maintainer, recommends we simply disable IDN support for the time being, since the fix is incomplete: https://curl.haxx.se/mail/lib-2016-11/0033.html This is already the case; here is an excerpt from the build log: ------ 2797 checking whether to enable Windows native IDN (Windows native builds o= nly)... no 2798 checking whether to build with libidn2... (assumed) yes 2799 checking for pkg-config... (cached) /gnu/store/9z40bkd8q9s8krjkhqysrn2= 62gwsww4p-pkg-config-0.29/bin/pkg-config 2800 checking for libidn2 options with pkg-config... no 2801 configure: IDN_LIBS: "-lidn2" 2802 configure: IDN_LDFLAGS: "" 2803 configure: IDN_CPPFLAGS: "" 2804 configure: IDN_DIR: "" 2805 checking if idn2_lookup_ul can be linked... no 2806 checking idn2.h usability... no 2807 checking idn2.h presence... no 2808 checking for idn2.h... no 2809 configure: WARNING: Cannot find libraries for IDN support: IDN disabled [...] 3309 IDN support: no (--with-{libidn2,winidn}) ------ I hope this doesn't break the interface with any packages referring to the new curl with a graft. --0F1p//8PRICkK4MW Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJYGrcHAAoJECZG+jC6yn8IopwQAKoKjQ9mWvEAVAnZZinIIFzO HH3j16TYb93kEYQ9QayHpTokW5RDPSIAMMyDTDO4GMcllV88mzK1AR+i7Zeq8/A6 MomTk5clFEEs2f5kjJzOfwVuL1Dum4QKCzNkQcnMQ2IcX3DXVnNrRhZyWs6tqYic FX4YGVzyN7rUPUwDWrSTC44g7xoDY0Il52eSJF02uZwcg1wZ+i928yx2KpfypgUh gditWgdBUDyfdlnTyVz/QBCUf19MHS0AfhWqFxwS9g25PwZPyW1wBiJG7iFi9D6/ Se6t5Yamv6nsjHZMjJXgT1Kyk1sFzWg+q6b0iHP44ZtPD5sPUfRYguAWqezUd75l oMhNAwjI9wSPlQzakGVW9Y4mOaSmBoG3mH6fUEX7H7EEBObBvGTxlckTYG93IdIm JJGCazjiPMlfj7oGZS9w7qvXf+fIXuJ5IO0IVpfnj3X0maI9y3foCkxw9bn/G8c+ cIAHEhHX41+GTFIVys/lSJjfNr6R6rUQN35dOpDa68Zf3vABY0reLox7BCVENDw0 0lVIVmlrKi0xYrqGPu8OmRO/4AKDMu4BK8jHNKpr7ZCg4z0zQe6GiF0mfWnu52IO 2xQ8Rif0/MTeVDp+i9BgbTOFGuBGApNClzwUPpN8y8JJDFNsf/NCZ5NMpwFu8v76 5YhbYxB/F4QCDiO+H70M =Pp9q -----END PGP SIGNATURE----- --0F1p//8PRICkK4MW--