732640 – <dev-perl/Cpanel-JSON-XS-4.190.0: Multiple vulnerabilities

Bug 732640 - <dev-perl/Cpanel-JSON-XS-4.190.0: Multiple vulnerabilities

Summary: <dev-perl/Cpanel-JSON-XS-4.190.0: Multiple vulnerabilities

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2020-07-14 21:19 UTC by Sam James
Modified:	2020-09-13 21:59 UTC (History)
CC List:	2 users (show)

See Also:
Package list:	dev-perl/Cpanel-JSON-XS-4.190.0
Runtime testing required:	---

Flags:	nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-07-14 21:19:59 UTC

From https://gitweb.gentoo.org/repo/gentoo.git/commit?id=0a85eb8118bde263cadc525af8aa030d6e7abc8f:

"Upstream:
- Fix various memory corruptions"
- Fixed typed decode memory leak"

Comment 1 Kent Fredric (IRC: kent\n) (RETIRED) gentoo-dev

2020-07-14 23:59:25 UTC

The specific upstream changelog entries about leaks etc:

https://metacpan.org/source/RURBAN/Cpanel-JSON-XS-4.19/Changes#L6
https://github.com/rurban/Cpanel-JSON-XS/pull/160

https://metacpan.org/source/RURBAN/Cpanel-JSON-XS-4.19/Changes#L52
https://github.com/rurban/Cpanel-JSON-XS/pull/136

Comment 2 Sam James archtester

2020-08-05 18:13:11 UTC

ping, ready to stable?

Comment 3 Sam James archtester

2020-08-11 08:33:27 UTC

(In reply to Sam James from comment #2)
> ping, ready to stable?

ping

Comment 4 Sam James archtester

2020-08-12 10:29:14 UTC

sparc done

Comment 5 Sam James archtester

2020-08-14 22:30:49 UTC

x86 done

Comment 6 Sam James archtester

2020-08-14 23:50:13 UTC

amd64 done

Comment 7 Agostino Sarubbo gentoo-dev

2020-08-16 14:47:59 UTC

s390 stable

Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev

2020-09-06 08:17:04 UTC

hppa stable

Comment 9 Sam James archtester

2020-09-06 14:20:57 UTC

Please cleanup.

Comment 10 Larry the Git Cow gentoo-dev

2020-09-07 09:26:10 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=17810e63a91dbe5c19e948cfccc4b9a0e382fbde

commit 17810e63a91dbe5c19e948cfccc4b9a0e382fbde
Author:     Kent Fredric <kentnl@gentoo.org>
AuthorDate: 2020-09-07 09:25:40 +0000
Commit:     Kent Fredric <kentnl@gentoo.org>
CommitDate: 2020-09-07 09:25:40 +0000

    dev-perl/Cpanel-JSON-XS: Cleanup old 3.23.900 re bug #732640
    
    Bug: https://bugs.gentoo.org/732640
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Kent Fredric <kentnl@gentoo.org>

 .../Cpanel-JSON-XS/Cpanel-JSON-XS-3.23.900.ebuild  | 25 ----------------------
 dev-perl/Cpanel-JSON-XS/Manifest                   |  1 -
 2 files changed, 26 deletions(-)

Comment 11 Sam James archtester

2020-09-07 16:37:11 UTC

thanks!

Comment 12 Thomas Deutschmann (RETIRED) gentoo-dev

2020-09-13 21:59:14 UTC

GLSA Vote: No!

Repository is clean, all done.