CVE-2020-27207 (https://github.com/sqlcipher/sqlcipher/compare/v4.4.0...v4.4.1): Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read. Maintainer, please bump to 4.4.1.
Package list is empty or all packages have requested keywords.
Simply renaming the latest ebuild to the 4.5.0 works like a charm here.
Arches, please test and mark stable: =dev-db/sqlcipher-4.5.1 Thanks in advance
No, stabilizations are not done in security bugs anymore, as announced here: https://archives.gentoo.org/gentoo-dev-announce/message/66f1227144d451eac3c1f641771be557 Please also remember to use Bug: tags to associate the security bump to the security bug.
Please cleanup.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ff28e488512db2d448a46dd2144a846399904cc7 commit ff28e488512db2d448a46dd2144a846399904cc7 Author: Sergey Popov <pinkbyte@gentoo.org> AuthorDate: 2022-04-11 07:00:16 +0000 Commit: Sergey Popov <pinkbyte@gentoo.org> CommitDate: 2022-04-11 07:00:29 +0000 dev-dv/sqlcipher: drop old vulnerable version Bug: https://bugs.gentoo.org/760690 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Sergey Popov <pinkbyte@gentoo.org> dev-db/sqlcipher/Manifest | 1 - dev-db/sqlcipher/sqlcipher-4.0.1.ebuild | 70 --------------------------------- 2 files changed, 71 deletions(-)
