From https://gitweb.gentoo.org/repo/gentoo.git/commit?id=5aa87584945e5ae652c70e9504273ed6de9baa2f: "Upstream: - Upgrade bundled SQLite to 3.29.0 for * security fixes * ALTER TABLE ... RENAME COLUMN * UPSERT" I'm concerned about this because 3.29 isn't the latest and most SQLite releases have security fixes.
(In reply to Sam James from comment #0) > From > https://gitweb.gentoo.org/repo/gentoo.git/ > commit?id=5aa87584945e5ae652c70e9504273ed6de9baa2f: > > "Upstream: > - Upgrade bundled SQLite to 3.29.0 for > * security fixes > * ALTER TABLE ... RENAME COLUMN > * UPSERT" > > I'm concerned about this because 3.29 isn't the latest and most SQLite > releases have security fixes. Indeed. This is somewhat unavoidable, and bundling is a necessity as its frequently broken by system-sqlite. ( and USE=system-sqlite is use.stable.masked for this reason ) system-sqlite is working "For now", but history proves we can make no guarantees about this.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=44c87eb13d21ec3698e1ff15422415b628981da1 commit 44c87eb13d21ec3698e1ff15422415b628981da1 Author: Kent Fredric <kentnl@gentoo.org> AuthorDate: 2020-08-31 05:17:16 +0000 Commit: Kent Fredric <kentnl@gentoo.org> CommitDate: 2020-08-31 05:18:31 +0000 dev-perl/DBD-SQLite: Bump to version 1.660.0 Upstream: - Upgrade bundled SQLite to 3.32.3 - Add several SQL_ types as alias - Don't return unitialized local variable when unexpected number of results returned in perl_vt_Eof() https://github.com/DBD-SQLite/DBD-SQLite/pull/55 - Ensure filename is defined in sqlite_db_filename https://github.com/DBD-SQLite/DBD-SQLite/pull/54 - Allow create_function to return an an array reference to specify the type of the value Bug: https://bugs.gentoo.org/732638 Package-Manager: Portage-3.0.4, Repoman-3.0.1 Signed-off-by: Kent Fredric <kentnl@gentoo.org> dev-perl/DBD-SQLite/DBD-SQLite-1.660.0.ebuild | 58 +++++++++++++++++++++++++++ dev-perl/DBD-SQLite/Manifest | 1 + dev-perl/DBD-SQLite/metadata.xml | 1 + 3 files changed, 60 insertions(+)
For some reason, un-USE-masking isn't working either: /etc/portage/profile/package.use.stable.mask/system-libs dev-perl/DBD-SQLite -system_sqlite ...gets ignored by Portage...
Time to stable?
(In reply to Luke-Jr from comment #3) > For some reason, un-USE-masking isn't working either: > > /etc/portage/profile/package.use.stable.mask/system-libs > dev-perl/DBD-SQLite -system_sqlite > > ...gets ignored by Portage... That'll be because its a hyphen, not an underscore.
arm64 done
arm done
amd64 done
s390 stable
sparc stable
x86 stable
ppc stable
ppc64 stable
hppa stable
Bundled version is 3.22.0, and that version appears to be affected by CVE-{2018-{8740,20346,20505,20506},2019-{5018,8457,9936,9937,16168}}, which in our Bugzilla is bug 650952, bug 672942, bug 685838, bug 684840, and bug 697678, and we don't have a bug for CVE-2018-2050{5,6} or CVE-2019-8457. The worst whiteboard any of these bugs have is A2. It seems that CVE-2018-20506 can allow SQL RCE, too. Maintainers, please cleanup.
Dropping to C due to system-sqlite package.use.stable.mask. Maintainer: Ping, please cleanup.
(In reply to John Helmert III from comment #16) > Dropping to C due to system-sqlite package.use.stable.mask. Maintainer: > Ping, please cleanup. Cleanup done
GLSA Vote: No
