Bugzilla Bug 74011

glsa-check/automake-wrapper false alarm

<snip>
porkoo ~ # glsa-check -t all
WARNING: This ...

This system is affected by the following GLSA:
200404-08
</snip>

<snip>
GLSA 200404-08: 
GNU Automake symbolic link vulnerability          
============================================================================
Synopsis: ...

Affected package:  sys-devel/automake
Affected archs:    All
Vulnerable:        <1.8.3
Unaffected:        >=1.8.3
</snip>

<snip>
porkoo ~ # equery l -p automake
[ Searching for package 'automake' in all categories among: ]
 * installed packages
[I--] [  ] sys-devel/automake-1.4_p6 (1.4)
[I--] [  ] sys-devel/automake-1.5 (1.5)
[I--] [  ] sys-devel/automake-1.6.3 (1.6)
[I--] [  ] sys-devel/automake-1.7.9 (1.7)
[I--] [  ] sys-devel/automake-1.9.3 (1.9)
[I--] [  ] sys-devel/automake-1.8.5-r2 (1.8)
[I--] [  ] sys-devel/automake-wrapper-1 (0)
 * Portage tree (/usr/portage)
[-P-] [  ] sys-devel/automake-1.8.5-r1 (1.5)
</snip>

GLSA says all automake < 1.8.3 is vulnerable. You have automake-1.4_p6,
automake-1.5, automake-1.6.3 and automake-1.7.9 installed. glsa-check says you
are affected. Looks like glsa-check is right. Please explain how this is an
error.

After a little chat it's a little more clear...

automake-wrapper has the following RDEPENDS:
RDEPEND="=sys-devel/automake-1.4*
         =sys-devel/automake-1.5*
         =sys-devel/automake-1.6*
         =sys-devel/automake-1.7*
         =sys-devel/automake-1.8.5-r2
         =sys-devel/automake-1.9*"

[M~] sys-devel/automake-1.5 (1.5)
[M~] sys-devel/automake-1.4_p6 (1.4)
[M~] sys-devel/automake-1.6.3 (1.6)
[M~] sys-devel/automake-1.7.9 (1.7)
[  ] sys-devel/automake-1.8.5-r1 (1.5)
[M~] sys-devel/automake-1.8.5-r2 (1.8)
[M~] sys-devel/automake-1.9.3 (1.9)

So portage still contains (probably) vulnerable versions... And automake-wrapper even requires them.

base-system, please advise... Are all these versions fixed ? Will they be ? If not, can they be removed ?

can/will they be removed ? no, probably never

those versions have always been in the tree ... 1.8.5-r1 and earlier always packaged the older versions in one ebuild

are they fixed ?  i have nfc what the bug is so i couldnt tell you

clue: GLSA 200404-08, bug 45646
Looks like a tempfile vuln, was fixed by solar through :

-	epatch ${FILESDIR}/${P}-infopage-namechange.patch
+	epatch ${FILESDIR}/${PN}-1.8.2-infopage-namechange.patch

I suppose the other versions (other than the stable 1.8.* slot) are not fixed.

the vuln seems to have been introduced during the 1.7.x cycle

that means 1.4_p6, 1.5, and 1.6.3 are not affected

ive added the patch to 1.7.9, 1.8.5-r2, and made a new patch for 1.9.3 ... i thought this was supposed to be fixed upstream ?

Hmm it was before my time, so I don't know if it was forwarded upstream.
Obviously it wasn't, or upstream didn't care.

Could you revbump to 1.7.9-r1 and 1.9.3-r1 so that we can update the old GLSA
instructions to match ?

About 1.8.5-r2, didn't it already have the patch ? If not, then revbump to -r3
too (and remove once-affected -r2 to simplify)

*** Bug 75477 has been marked as a duplicate of this bug. ***

The problem still exists...

This bug has been here for months... any idea when it might get fixed?

Hi, I'm just did an emerge sync, and I'm noticing that Portage suddenly wants
to install half a dozen versions of automake (and a few of autoconf). Can
someone on this thread tell me why automake-wrapper tries to install so many
versions of automake, and why we suddenly need them all now, when we didn't
need them before?

Chris: this bug hasn't been sitting there for months, but just for a month.
It's partially fixed (portage does not carry any vulnerable version anymore)
but still needs a few revbumps and an updated GLSA so that glsa-check does not
report you're vulnerable while you're not.

vapier: currently portage has :
sys-devel/automake-1.4_p6 (1.4) -> not affected
sys-devel/automake-1.5 (1.5) -> not affected
sys-devel/automake-1.6.3 (1.6) -> not affected
sys-devel/automake-1.7.9 (1.7) -> patched, requires revbump
sys-devel/automake-1.8.5-r2 (1.8) -> patched, requires revbump ?
sys-devel/automake-1.9.4 (1.9) -> patched (SLOT always included the patch)

Please revbump those who need it, and tell me which 1.8.5 version includes the
fix, so that we can update GLSA 200404-08 as :

Unaffected :
sys-devel/automake <  1.7
sys-devel/automake *>= 1.7.9-r1
sys-devel/automake >= 1.8.5-r3 (or is it 1.8.5 ?)

Affected :
sys-devel/automake < 1.8.5-r3 (or is it 1.8.5 ?)

How does one revbump?  I'm confused.

And there is no automake-1.8.5-r3 at least not in portage.  r2 is the highest I see.

All what is below "vapier:" in my latest comment is for vapier (the package
maintainer) not for you. He is the one that will do the revbumping (i.e. create
new ebuild revisions).

sys-devel/automake-1.7.9-r1 and sys-devel/automake-1.8.5-r3 have both been rev
bumped

alpha, sparc, mips, ppc, ppc64:
Do you plan on using the new SLOTed automake(s) anytime soon ? I have to update the GLSA for the arches who do (amd64,arm,hppa,ia64,s390,sh,x86), but it may be simpler to wait for you to use them too, if it's soon.

To make the switch you have to mark stable :
sys-devel/automake-1.4_p6 (1.4)
sys-devel/automake-1.5 (1.5)
sys-devel/automake-1.6.3 (1.6)
sys-devel/automake-1.7.9-r1 (1.7)
sys-devel/automake-1.8.5-r3 (1.8)
sys-devel/automake-1.9.4 (1.9)

If you can't do it for whatever reason, please comment so that I don't wait for you to fix the GLSA.

Well, sys-devel/automake-1.8.5-r3 is in portage today, but
sys-devel/automake-1.8.5-r2 is now masked and since automake-wrapper still
specifies sys-devel/automake-1.8.5-r2 in it's dependencies now "emerge -uD
anything" or "emerge -e anything" no longer work.

Can we please have an updated autmake-wrapper that has a sensible depends like
"=sys-devel/automake-1.8*" and avoid this problem?

vapier: automake-wrapper needs a quick fix to handle the new rev...

Yes it does, see the pile-up on bug #79926
May be mark this bug as blocker for #79926 ?

stable on ppc64

I can confirm that automake-1.8.5-r3 was installed on my box but glsa-check
still removes automake-1.5 (and installs automake-1.8.5-r1 in it's place).

So, I'm assuming this means that the glsa-check script will simply be changed
sometime in the future for this.

err, sorry, fixed automake-wrapper

we cant depend on 1.8* yet because 1.8.5-r1 will match that

Stable on ppc.

Alpha keyworded.

Still needing sparc to mark stable as detailed in comment #15.
Then we'll proceed in updating the GLSA as detailed in comment #11.

sparc done.

new GLSA 200404-08 committed to Portage. Should be on mirrors in 30 minutes,
please test that it accurately reports vulnerability status.

glsa-check -f 200404-08
This re-emerged 1.8.5-r3

So it was still complaining.. I needed to:
emerge =automake-1.7.9-r1

then the glsa-check showed clear....
Cheers all..

I'll suppose this means it works... Please reopen if it doesn't.

Mips done.