From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: curl security update Date: Thu, 04 Aug 2016 16:28:59 +0200 Message-ID: <87a8gsvc9g.fsf@gnu.org> References: <20160804131139.GA7359@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:49401) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVJe0-0005nl-DD for guix-devel@gnu.org; Thu, 04 Aug 2016 10:29:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bVJdw-0004N4-60 for guix-devel@gnu.org; Thu, 04 Aug 2016 10:29:08 -0400 In-Reply-To: <20160804131139.GA7359@jasmine> (Leo Famulari's message of "Thu, 4 Aug 2016 09:11:39 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari skribis: > There are some new bugs disclosed in curl: > https://curl.haxx.se/docs/security.html > > Grafting the new version seems like the right approach to me when I > consider libcurl's ABI compatibility policy: > https://curl.haxx.se/libcurl/abi.html Sounds good. > From ef6ae3732facb1eba77e82c6a6066832784bca5d Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Wed, 3 Aug 2016 16:13:09 -0400 > Subject: [PATCH] gnu: curl: Replace with 7.50.1 [fixes > CVE-2016-{3739,4802,5419,5420,5421]. Strangely =E2=80=98guix lint -c cve=E2=80=99 only reports CVE-2016-3739, an= noying. > * gnu/packages/curl.scm (curl)[replacement]: New field. > (curl-7.50.1): New variable. LGTM! Thank you! Ludo=E2=80=99.