Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 339863 - <dev-util/buildbot-0.8.0_p1: XSS vulnerability
Summary: <dev-util/buildbot-0.8.0_p1: XSS vulnerability
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://buildbot.net/trac/wiki/Securit...
Whiteboard: ?? [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-05 19:25 UTC by Dirkjan Ochtman (RETIRED)
Modified: 2010-12-31 08:58 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
build.log, bzip2 compressed (buildbot-build.log.bz2,37.94 KB, application/x-bzip2)
2010-11-07 22:37 UTC, Christian Faulhammer (RETIRED)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dirkjan Ochtman (RETIRED) gentoo-dev 2010-10-05 19:25:33 UTC
See URL for details. I'm putting 0.8.0p1 in the tree because 0.8.1p1 is missing some stuff in the tarball, but I'm told that will be fixed soon. Should we stabilize sooner?
Comment 1 Mark Loeser (RETIRED) gentoo-dev 2010-11-06 20:49:01 UTC
bug #325899 should be closed in favor of pushing this as soon as possible since its already stable for most archs.
Comment 2 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2010-11-07 15:00:23 UTC
Stabilize dev-util/buildbot-0.8.0_p1.
Comment 3 Christian Faulhammer (RETIRED) gentoo-dev 2010-11-07 22:37:31 UTC
Created attachment 253563 [details]
build.log, bzip2 compressed

Fails tests, no regression though.

Portage 2.1.8.3 (default/linux/x86/10.0/desktop, gcc-4.4.4, glibc-2.11.2-r3, 2.6.35-gentoo-r12 i686)
=================================================================
System uname: Linux-2.6.35-gentoo-r12-i686-AMD_Athlon-tm-_X2_Dual_Core_Processor_BE-2400-with-gentoo-1.12.14
Timestamp of tree: Sun, 07 Nov 2010 21:30:21 +0000
distcc 3.1 i686-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     4.1_p7
dev-java/java-config: 2.1.11
dev-lang/python:     2.6.5-r3, 3.1.2-r4
dev-util/ccache:     2.4-r7
dev-util/cmake:      2.8.1-r2
sys-apps/baselayout: 1.12.14-r1
sys-apps/sandbox:    2.3-r1
sys-devel/autoconf:  2.13, 2.65-r1
sys-devel/automake:  1.4_p6-r1, 1.5-r1, 1.6.3-r1, 1.7.9-r2, 1.8.5-r4, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.3.4, 4.4.4-r2
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.10
sys-devel/make:      3.81-r2
virtual/os-headers:  2.6.30-r1
ACCEPT_KEYWORDS="x86"
ACCEPT_LICENSE="*"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=athlon-xp -pipe -msse3"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /opt/openfire/resources/security/ /opt/openjms/config /usr/lib/fax /usr/share/X11/xkb /usr/share/config /usr/share/openvpn/easy-rsa /var/bind /var/lib/hsqldb /var/spool/fax/etc /var/spool/torque"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/eselect/postgresql /etc/fonts/fonts.conf /etc/games/angband/edit/ /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/splash /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -march=athlon-xp -pipe -msse3"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests ccache distlocks fixpackages metadata-transfer news parallel-fetch protect-owned sandbox sfperms strict unmerge-logs unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LANG="de_DE.utf8"
LC_ALL="de_DE.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu"
LINGUAS="de"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext X a52 aac aiglx alsa applet artworkextra asf astribank audiofile bash-completion berkdb bidi bluetooth bogofilter bootsplash branding bzip2 cairo ccache cdda cddb cdparanoia cdr cli compat console consolekit cracklib crypt css cups curl custom-cflags cxx dbus deskbar dga directfb divx4linux dri dts dvd dvdr dvdread dvi emacs emboss encode evince exif extensions fam fat fbcon fbcondecor fdftk ffmpeg fontconfig foomaticdb fortran ftp gb gcj gdbm gif glitz gphoto2 gpm gsf gtk gtk2 gtkhtml hal howl iconv icq idn imagemagick imlib ipv6 java javascript jpeg jpeg2k kde kpathsea libnotify libotf lirc lm_sensors mad matroska melt mikmod mime mjpeg mmx mmxext mng modules mp3 mp4 mpeg mpeg2 mudflap mule mysql ncurses networking nforce2 nls noaudio nocardbus novideo nowebdav nptl nptlonly nss nvidia objc objc++ objc-gc ocamlopt offensive ogg opengl openmp pam pango passwordsave pcre pdf perl plotutils pmu png policykit ppds pppd prediction preview-latex print publishers python qt-static qt3support qt4 readline reports run-as-root samba sdk sdl secure-delete semantic-desktop session slang smp spell sse ssl startup-notification static-analyzer svg svga sysfs t1lib tcpd theora threads thumbnailing tiff tk toolkit-scroll-bars totem truetype truetype-fonts type1-fonts udev unicode usb userlocales vcd videos vorbis win32codecs wmf wxwindows x264 x86 xcb xface xft xml xorg xosd xpm xulrunner xv xvid zlib" ALSA_CARDS="intel8x0" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="mouse keyboard evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="de" LIRC_DEVICES="atiusb" PHP_TARGETS="php5-2" RUBY_TARGETS="jruby ruby18 ree18" USERLAND="GNU" VIDEO_CARDS="radeon" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 4 Dustin J. Mitchell 2010-11-08 02:59:31 UTC
Please don't attach compressed logs as text/plain!
Comment 5 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2010-11-08 12:47:19 UTC
(In reply to comment #3)

Which versions of dev-python/jinja and dev-python/twisted?
Does this problem occur with >=dev-python/jinja-2.5.5, >=dev-python/twisted-10.1.0 and >=dev-util/buildbot-0.8.2?
Comment 6 Christian Faulhammer (RETIRED) gentoo-dev 2010-11-08 17:15:44 UTC
(In reply to comment #5)
> (In reply to comment #3)
> 
> Which versions of dev-python/jinja and dev-python/twisted?
> Does this problem occur with >=dev-python/jinja-2.5.5,
> >=dev-python/twisted-10.1.0 and >=dev-util/buildbot-0.8.2?

 Yes.
Comment 7 Christian Faulhammer (RETIRED) gentoo-dev 2010-11-08 17:22:41 UTC
x86 stable nonetheless, no regression, seems to work.
Comment 8 Dustin J. Mitchell 2010-11-08 17:26:03 UTC
The failures are definitely a test problem, not a code problem, so stabling is fine.  I can't find the fix for the tests, but the failures have been fixed in newer versions.
Comment 9 Markos Chandras (RETIRED) gentoo-dev 2010-11-08 19:31:48 UTC
amd64 done. FYI, the hppa deptree is broken

dev-util/buildbot/buildbot-0.8.2.ebuild: ~hppa(default/linux/hppa/10.0) ['dev-python/mock']
Comment 10 Jeroen Roovers (RETIRED) gentoo-dev 2010-11-08 19:46:28 UTC
Stable for HPPA PPC.
Comment 11 Markus Meier gentoo-dev 2010-11-10 12:56:03 UTC
arm stable
Comment 12 Raúl Porcel (RETIRED) gentoo-dev 2010-11-14 16:38:59 UTC
alpha/ia64/s390/sh/sparc stable 
Comment 13 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2010-12-19 22:10:24 UTC
dev-util/buildbot-0.8.2 and dev-util/buildbot-slave-0.8.2 will be stabilized in bug #349143, so inactive architectures might skip bug #339863.
Comment 14 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2010-12-30 17:35:10 UTC
dev-util/buildbot-0.8.2 has been stabilized on ppc64 in bug #349143.
Comment 15 Tim Sammut (RETIRED) gentoo-dev 2010-12-31 08:58:57 UTC
Thanks everyone. Closing noglsa for Web App XSS.