From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: kdesu security update needed Date: Sat, 01 Oct 2016 14:19:05 +0200 Message-ID: <87eg40i7nq.fsf@gnu.org> References: <20160929152353.GA6330@jasmine> <20160929204932.GA25044@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34518) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bqJG6-0005k9-GD for guix-devel@gnu.org; Sat, 01 Oct 2016 08:19:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bqJG0-000774-Dz for guix-devel@gnu.org; Sat, 01 Oct 2016 08:19:13 -0400 In-Reply-To: <20160929204932.GA25044@jasmine> (Leo Famulari's message of "Thu, 29 Sep 2016 16:49:32 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel Leo Famulari skribis: > On Thu, Sep 29, 2016 at 08:52:34PM +0200, David Craven wrote: >> Ah just checked our linter doesn't flag a CVE, so I think we're ok... > > The linter is a good tool for catching things that we miss, but it's not > a substitute for manual investigation :) +1 > First, our package's name might not match the name used by the Common > Platform Enumeration [0], which is the name that the linter looks up. We > can give packages a cpe-name property [1], which tells the linter to use > something besides the package's name. > > Second, I've noticed that sometimes bugs are publicized on oss-sec or > elsewhere, but then they don't show up in the CVE database for a while. Often, vulnerabilities and CVE IDs are publicized when the CVE ID is still marked as =E2=80=9Creserved=E2=80=9D without additional info; reserve= d CVE IDs don=E2=80=99t show up in the CVE database that =E2=80=98guix lint=E2=80=99 = fetches. > An aside, the CVE linter gives false positives for grafted packages. For > example, try `guix lint -c cve openssl@1.0`. That=E2=80=99s been annoying me for some time so I=E2=80=99d like to see if= we can improve grafting in a way that would allow us to use a different version number in the package replacement, which in turn would allow =E2=80=98guix = lint=E2=80=99 to see the right version number of the replacement. Ludo=E2=80=99.