| Summary: | mail-client/alpine bundles a vunerable copy of uw-imap/c-client (fails to build with USE=ssl and USE=kerberos), GLSA 200911-03 | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Kacper Kowalik (Xarthisius) (RETIRED) <xarthisius> |
| Component: | Current packages | Assignee: | Sascha Lucas <sascha_lucas> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | andy.dalton, atoth, bug, cedric.godin, che, gentoo_bugs_2_peep, gseanmcg, kwilson, longbow, net-mail+disabled, security, srcshelton, tpfaff, vereecke.jan |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 251464 | ||
| Attachments: |
build log
add -lcrypto to LIBS |
||
|
Description
Kacper Kowalik (Xarthisius) (RETIRED)
2011-11-22 15:06:35 UTC
Created attachment 293611 [details, diff] add -lcrypto to LIBS I don't know what might have changed, but after adding -lcrypto to libs it works. Following patch is required for the ebuild : --- /usr/portage/mail-client/alpine/alpine-2.00-r4.ebuild 2011-09-03 19:01:16.000000000 +0200 +++ alpine-2.00-r4.ebuild 2011-11-24 12:09:02.841176822 +0100 @@ -4,7 +4,7 @@ EAPI="2" -inherit eutils flag-o-matic +inherit eutils autotools flag-o-matic # http://staff.washington.edu/chappa/alpine/patches/${P}/log.txt CHAPPA_PL="73" @@ -64,7 +64,10 @@ src_prepare() { use chappa && epatch "${DISTDIR}"/${P}-chappa-${CHAPPA_PL}-all.patch.gz use topal && epatch /usr/share/topal/patches/${P}.patch-{1,2} - + if use ssl ; then + epatch "${FILESDIR}"/2.00-lcrypto.patch + eautoreconf + fi epatch "${FILESDIR}"/2.00-lpam.patch cd "${S}/imap/src/c-client" epatch "${FILESDIR}"/CVE-2008-5514.patch Digging a little deeper i found that this is caused by the recent binutils update to 2.22. Building with the former release 2.21.1 worked without adding lcrypto to LDFLAGS. Hi, (In reply to comment #2) > Digging a little deeper i found that this is caused by the recent binutils > update to 2.22. Building with the former release 2.21.1 worked without adding > lcrypto to LDFLAGS. thanks a lot for your investigation. i'm working to push this into main portage-tree. Sascha. *** Bug 431454 has been marked as a duplicate of this bug. *** (In reply to comment #3) > thanks a lot for your investigation. i'm working to push this into main > portage-tree. ping? With mail-client/pine masked for removal, this bug is somewhat more urgent now. Thanks. In the alpine source, the directory 'imap' is the upstream uw-imap imap source, of an intermediate unreleased version, labelled 2007c, between the released 2007b and 2007d. As such, it has the two security vulnerabilities for c-client as described by GLSA 200911-03. It should link dynamically against virtual/imap-c-client, and NOT used the bundled version at all. This will also provide you with all of the other fixes in the uw-imap/c-client package for free. *** Bug 267918 has been marked as a duplicate of this bug. *** (In reply to comment #6) > It should link dynamically against virtual/imap-c-client, and NOT used the > bundled version at all. Should be "fixed" in =mail-client/alpine-2.00-r5. In order not to lose maildir support in alpine, part of the Chappa patches moved to c-client library. Too much of a hack and nothing to be proud of but the alternative was worse. I have decided against using Chappa patches for net-mail/uw-imap -the daemon- and only patched net-libs/c-client. Please let me know if you have any problems/suggestions. The code shows its age and is not pleasant to work with btw. Currently installed alpine-2.00-r5, seems to work, no problems so far. :) *** Bug 439266 has been marked as a duplicate of this bug. *** *** Bug 440246 has been marked as a duplicate of this bug. *** hi all!
i am a little confused about the update of alpine to 2.00-r5 cause it causes a block here with my uw-imap installation:
area52 ~ # emerge -av alpine
These are the packages that would be merged, in order:
Calculating dependencies... done!
[ebuild N ] net-libs/c-client-2007f-r4 USE="chappa ipv6 pam ssl -doc -kerberos -static-libs -topal" 30 kB
[ebuild U ] mail-client/alpine-2.00-r5 [2.00-r4] USE="chappa ipv6 nls -doc -kerberos -ldap -onlyalpine -passfile -smime -spell -ssl -threads -t opal" 208 kB
[blocks B ] net-libs/c-client ("net-libs/c-client" is blocking net-mail/uw-imap-2007f-r1)
[blocks B ] net-mail/uw-imap ("net-mail/uw-imap" is blocking net-libs/c-client-2007f-r4)
Total: 2 packages (1 upgrade, 1 new), Size of downloads: 238 kB
Conflict: 2 blocks (2 unsatisfied)
* Error: The above package list contains packages which cannot be
* installed at the same time on the same system.
(net-libs/c-client-2007f-r4::gentoo, ebuild scheduled for merge) pulled in by
>=net-libs/c-client-2007f-r4[-topal,chappa] required by (mail-client/alpine-2.00-r5::gentoo, ebuild scheduled for merge)
(net-mail/uw-imap-2007f-r1::gentoo, installed) pulled in by
net-mail/uw-imap required by @selected
For more information about Blocked Packages, please refer to the following
section of the Gentoo Linux x86 Handbook (architecture is irrelevant):
http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?full=1#blocked
The following USE changes are necessary to proceed:
#required by mail-client/alpine-2.00-r5, required by @selected, required by @world (argument)
>=net-libs/c-client-2007f-r4 chappa
Use --autounmask-write to write changes to config files (honoring CONFIG_PROTECT).
i hope theres a way out of this confusion...
(In reply to comment #12) > i am a little confused about the update of alpine to 2.00-r5 cause it causes > a block here with my uw-imap installation: Correct. Unfortunately, we do not support alpine and uw-imap at the same time currently (because of unbundling of c-client library). One has to patch uw-imap with chappa patches to support alpine and I do not think patching uw-imap is such a good idea. Some other text based mail client might be a possible solution. |
