Re: Adding packages with vulnerabilities (was Re: [PATCH 1/2] gnu: Add perl-net-psyc. [pcre])

[ng0 <ngillmann@runbox.com>]

Ludovic Courtès <ludo@gnu.org> writes:

> Leo Famulari <leo@famulari.name> skribis:
>
>> On Thu, Sep 29, 2016 at 08:58:29AM +0000, ng0 wrote:
>>> Leo Famulari <leo@famulari.name> writes:
>>> > On Wed, Sep 21, 2016 at 06:46:31PM +0000, ng0 wrote:
>>> >> Subject: [PATCH 1/2] gnu: Add psyclpc.
>>> >> 
>>> >> * gnu/packages/psyc.scm (psyclpc): New variable.
>>
>>> >> +    (inputs
>>> >> +     `(("zlib" ,zlib)
>>> >> +       ("openssl" ,openssl)))
>>> >> +    ;; pcre is bundled to ensure the version is compatible. XXX: look into
>>> >> +    ;; unbundling it. Upstream should update from pcre 4.5 to 8.38. For
>>> >> +    ;; functionality reasons we can not unbundle it now.
>>> >> +    ;; ("pcre" ,pcre)))
>>> >
>>> > That version of PCRE was released in 2003. We might want to add a
>>> > warning to the package description...
>>> >
>>> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pcre
>>> 
>>> Update on this: the pcre bundling was inherited from ldmud, current
>>> ldmud has unbundled pcre, so we will be able to unbundle pcre.
>>> 
>>> I'd still like to have the patches in their current form and update
>>> psyclpc when the next version without pcre is out.
>>
>> I'd like some more opinions on this. Should we add this package even
>> though we know it contains some security bugs (linked above)?
>
> I don’t think so.
>
> From the comment above, it seems difficult to have this package use a
> current version of PCRE, right?  Then I would suggest discussing it with
> upstream.  After all, they’re developing network-facing software, so
> they’re probably interested in avoiding security issues.
>
> ng0, could you take it with them?
>
> TIA,
> Ludo’.
>

Leo, Ludovic: I really appreciate the review, but please use the more
current thread. I commented that this is the wrong thread and that we
already fixed the pcre, last week. No need to discuss about pcre
anymore.

Thanks
--