Summary: | <net-im/telegram-desktop{,-bin}-2.2.0-r1: Possible access restriction bypass for downloads (CVE-2020-17448) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Sam James <sam> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | gyakovlev, henning, np-hardass, proxy-maint |
Priority: | Normal | Keywords: | PullRequest |
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
See Also: | https://github.com/gentoo/gentoo/pull/17166 | ||
Whiteboard: | B4 [glsa+ cve] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 749288 | ||
Bug Blocks: |
Description
Sam James
2020-08-11 18:10:47 UTC
* net-im/telegram-desktop needs stabilisation of 2.2.0-r1. * net-im/telegram-desktop-bin needs a bump to 2.2.0. Please bump. Did not look into the details, maybe a CVE means we need to remove the old ebuild as well. Please let me know here or in the pull request. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df8099bca70b27ea79af4a5a18cd9552d22aed95 commit df8099bca70b27ea79af4a5a18cd9552d22aed95 Author: Henning Schild <henning@hennsch.de> AuthorDate: 2020-08-18 21:51:36 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2020-08-29 01:24:56 +0000 net-im/telegram-desktop-bin: bump version to 2.2.0 Bug: https://bugs.gentoo.org/736774 Signed-off-by: Henning Schild <henning@hennsch.de> Signed-off-by: Sam James <sam@gentoo.org> net-im/telegram-desktop-bin/Manifest | 3 ++ .../telegram-desktop-bin-2.2.0.ebuild | 58 ++++++++++++++++++++++ 2 files changed, 61 insertions(+) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4364658df0ff6f92297648a32dbd28efac732e80 commit 4364658df0ff6f92297648a32dbd28efac732e80 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2020-10-26 08:00:00 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2020-10-26 08:01:28 +0000 net-im/telegram-desktop: bump to 2.4.4 webrtc is imposibble to turn off for now, unfortunately. webrtc alsa and pulseaudio will be forced on for now. add system-rlottie useflag. for now tg_owt bundles the following: openh264 abseil-cpp libsrtp libvpx libyuv pffft rnnoise usrsctp Bug: https://bugs.gentoo.org/736774 Bug: https://bugs.gentoo.org/749288 Closes: https://bugs.gentoo.org/739466 Closes: https://bugs.gentoo.org/707272 Package-Manager: Portage-3.0.8, Repoman-3.0.2 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> net-im/telegram-desktop/Manifest | 2 + net-im/telegram-desktop/metadata.xml | 2 + .../telegram-desktop/telegram-desktop-2.4.4.ebuild | 184 +++++++++++++++++++++ 3 files changed, 188 insertions(+) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=398c40130021de759ec95b211689e9318c25ece9 commit 398c40130021de759ec95b211689e9318c25ece9 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2020-11-02 19:13:57 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2020-11-02 19:14:29 +0000 net-im/telegram-desktop: security cleanup Bug: https://bugs.gentoo.org/749288 Bug: https://bugs.gentoo.org/736774 Package-Manager: Portage-3.0.8, Repoman-3.0.2 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> net-im/telegram-desktop/Manifest | 2 - .../telegram-desktop-2.1.13.ebuild | 145 ------------------- .../telegram-desktop-2.2.0-r1.ebuild | 153 --------------------- 3 files changed, 300 deletions(-) This issue was resolved and addressed in GLSA 202101-34 at https://security.gentoo.org/glsa/202101-34 by GLSA coordinator Aaron Bauman (b-man). |