Bug 669174 – <x11-plugins/enigmail-2.0.8-r1: Downloads and runs unsandboxed binary data by default

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Kristian Fiskerstrand (RETIRED) 2018-10-21 08:26:36 UTC]

Enigmail >=2.0 currently downloads binary data by default for PEP-support. Both the pep-author and enigmail author has stated that this is primarily intended for windows based systems and can easily be disabled, or at the very least be behind a default-disabled USE flag in Gentoo. See debian discussion from ${URL}.

Primarily we can set the current pref("extensions.enigmail.pEpAutoDownload", true); to false instead of the default true

[Comment 1 Kristian Fiskerstrand (RETIRED) 2018-10-21 08:34:42 UTC]

Created attachment 552070 [details, diff]
Debian patch to disable auto download and junior mode

[Comment 2 Larry the Git Cow 2018-11-06 20:52:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fdbc92c73affef75a85f0099fd133ad76672ee4c

commit fdbc92c73affef75a85f0099fd133ad76672ee4c
Author:     Lars Wendler <[e-mail]>
AuthorDate: 2018-11-06 20:52:16 +0000
Commit:     Lars Wendler <[e-mail]>
CommitDate: 2018-11-06 20:52:16 +0000

    x11-plugins/enigmail: Revbump to not auto-download pEp binaries.
    
    Bug: https://bugs.gentoo.org/669174
    Package-Manager: Portage-2.3.51, Repoman-2.3.12
    Signed-off-by: Lars Wendler <[e-mail]>

 x11-plugins/enigmail/enigmail-2.0.8-r1.ebuild      | 86 ++++++++++++++++++++++
 .../files/enigmail-no_pEp_auto_download.patch      | 33 +++++++++
 2 files changed, 119 insertions(+)

[Comment 3 Kristian Fiskerstrand (RETIRED) 2018-11-25 17:15:13 UTC]

Arches, please stabilize x11-plugins/enigmail-2.0.8-r1

[Comment 4 Larry the Git Cow 2018-11-25 18:51:41 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a7f126b71f3dbb319c6676524d8a05160ec3cba0

commit a7f126b71f3dbb319c6676524d8a05160ec3cba0
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2018-11-25 18:51:26 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2018-11-25 18:51:26 +0000

    x11-plugins/enigmail: move stable keywords
    
    Bug: https://bugs.gentoo.org/669174
    Package-Manager: Portage-2.3.52, Repoman-2.3.12
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 x11-plugins/enigmail/enigmail-2.0.8-r1.ebuild |  2 +-
 x11-plugins/enigmail/enigmail-2.0.8.ebuild    | 82 ---------------------------
 2 files changed, 1 insertion(+), 83 deletions(-)

[Comment 5 Thomas Deutschmann (RETIRED) 2018-11-25 18:53:22 UTC]

All done.

GLSA Vote: No

Repository is clean.