Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 400877 - net-misc/dropbox-1.2.48-r1: remove packaged openssl libs
Summary: net-misc/dropbox-1.2.48-r1: remove packaged openssl libs
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Naohiro Aota
URL:
Whiteboard:
Keywords: EBUILD, PATCH, SECURITY
Depends on:
Blocks:
 
Reported: 2012-01-26 09:13 UTC by Ortwin Glueck
Modified: 2012-02-15 19:20 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
dropbox-1.2.48-r2.ebuild (dropbox-1.2.48-r2.ebuild,1.44 KB, text/plain)
2012-01-26 09:14 UTC, Ortwin Glueck 		Details
the same changes in form of a patch (299933.patch,510 bytes, patch)
2012-01-26 09:16 UTC, Ortwin Glueck 		Details | Diff
dropbox-1.2.51.ebuild (dropbox-1.2.51.ebuild,1.44 KB, text/plain)
2012-01-27 13:30 UTC, Ortwin Glueck 		Details
dropbox-1.2.51.ebuild (dropbox-1.2.51.ebuild,1.47 KB, text/plain)
2012-01-30 16:15 UTC, Ortwin Glueck 		Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ortwin Glueck 2012-01-26 09:13:24 UTC 
The ebuild installs the packaged openssl libraries into /opt/dropbox. These may be outdated and have unpatched security issues. Just remove them and the linker will use the openssl libs from the system.

The packaged version is currently 0.9.8e which has numerous CVEs filed against, while portage has 0.9.8t.

Reproducible: Always
Comment 1 Ortwin Glueck 2012-01-26 09:14:33 UTC 
Created attachment 299933 [details]
dropbox-1.2.48-r2.ebuild

added RDEPEND on openssl:0.9.8 and rm the packaged libs. Tested on x86_64.
Comment 2 Ortwin Glueck 2012-01-26 09:16:36 UTC 
Created attachment 299935 [details, diff]
the same changes in form of a patch
Comment 3 maxb 2012-01-27 13:03:53 UTC 
Hey guys,
please consider bumping to the latest stable, currently 1.2.51 according to https://www.dropbox.com/release_notes
Kind regards!
Comment 4 Ortwin Glueck 2012-01-27 13:30:00 UTC 
Created attachment 300041 [details]
dropbox-1.2.51.ebuild

version bump is only a matter of renaming the ebuild :-)
Comment 5 Ortwin Glueck 2012-01-30 16:15:51 UTC 
Created attachment 300413 [details]
dropbox-1.2.51.ebuild

also remove bundeled zlib and bz2
Comment 6 Justin Lecher (RETIRED) gentoo-dev 2012-02-15 19:20:55 UTC 
+*dropbox-1.2.51 (15 Feb 2012)
+
+  15 Feb 2012; Justin Lecher <jlec@gentoo.org> dropbox-1.2.13.ebuild,
+  dropbox-1.2.13-r1.ebuild, dropbox-1.2.13-r2.ebuild, dropbox-1.2.24.ebuild,
+  dropbox-1.2.24-r1.ebuild, dropbox-1.2.48.ebuild, +dropbox-1.2.51.ebuild,
+  metadata.xml:
+  Version Bump, #402501, drop a copuple of bundled libs, #400877, drop
+  mprotect() PaX flag, #401467, drop . from DESCRIPTION
+