950117 – <net-misc/socat-1.8.0.3: readline.sh log file is world-writable

Bug 950117 - <net-misc/socat-1.8.0.3: readline.sh log file is world-writable

Summary: <net-misc/socat-1.8.0.3: readline.sh log file is world-writable

Status:	IN_PROGRESS

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:
Whiteboard:	B4 [stable]
Keywords:

Depends on:	950514
Blocks:
	Show dependency tree

Reported:	2025-02-22 17:40 UTC by Sam James
Modified:	2025-03-23 10:28 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2025-02-22 17:40:13 UTC

```
+####################### V 1.8.0.3:
+
+Security:
+       readline.sh has new option -lf <logfile> for stderr. If this option is
+       not given it logs to a file in . (cwd) only when . is not writable by
+       other users.
```

Comment 1 Larry the Git Cow gentoo-dev

2025-02-22 17:44:31 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e857f9adaabf1374d203673749f69ee54c4c656f

commit e857f9adaabf1374d203673749f69ee54c4c656f
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2025-02-22 17:44:07 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2025-02-22 17:44:07 +0000

    net-misc/socat: add 1.8.0.3
    
    Bug: https://bugs.gentoo.org/950117
    Signed-off-by: Sam James <sam@gentoo.org>

 net-misc/socat/Manifest             |  1 +
 net-misc/socat/socat-1.8.0.3.ebuild | 60 +++++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)

Comment 2 John Helmert III archtester

2025-03-23 10:28:07 UTC

But we don't install that script, right? Upstream is deprecated [1]. The package has two rev-deps in ::gentoo tree currently.