Bug 400877

Summary:	net-misc/dropbox-1.2.48-r1: remove packaged openssl libs
Product:	Gentoo Linux	Reporter:	Ortwin Glueck <odi>
Component:	New packages	Assignee:	Naohiro Aota <naota>
Status:	RESOLVED FIXED
Severity:	normal	CC:	jan.bednar, jlec
Priority:	Normal	Keywords:	EBUILD, PATCH, SECURITY
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	dropbox-1.2.48-r2.ebuild the same changes in form of a patch dropbox-1.2.51.ebuild dropbox-1.2.51.ebuild

Description Ortwin Glueck 2012-01-26 09:13:24 UTC

The ebuild installs the packaged openssl libraries into /opt/dropbox. These may be outdated and have unpatched security issues. Just remove them and the linker will use the openssl libs from the system.

The packaged version is currently 0.9.8e which has numerous CVEs filed against, while portage has 0.9.8t.

Reproducible: Always

Comment 1 Ortwin Glueck 2012-01-26 09:14:33 UTC

Created attachment 299933 [details]
dropbox-1.2.48-r2.ebuild

added RDEPEND on openssl:0.9.8 and rm the packaged libs. Tested on x86_64.

Comment 2 Ortwin Glueck 2012-01-26 09:16:36 UTC

Created attachment 299935 [details, diff]
the same changes in form of a patch

Comment 3 maxb 2012-01-27 13:03:53 UTC

Hey guys,
please consider bumping to the latest stable, currently 1.2.51 according to https://www.dropbox.com/release_notes
Kind regards!

Comment 4 Ortwin Glueck 2012-01-27 13:30:00 UTC

Created attachment 300041 [details]
dropbox-1.2.51.ebuild

version bump is only a matter of renaming the ebuild :-)

Comment 5 Ortwin Glueck 2012-01-30 16:15:51 UTC

Created attachment 300413 [details]
dropbox-1.2.51.ebuild

also remove bundeled zlib and bz2

Comment 6 Justin Lecher (RETIRED) gentoo-dev

2012-02-15 19:20:55 UTC

+*dropbox-1.2.51 (15 Feb 2012)
+
+  15 Feb 2012; Justin Lecher <jlec@gentoo.org> dropbox-1.2.13.ebuild,
+  dropbox-1.2.13-r1.ebuild, dropbox-1.2.13-r2.ebuild, dropbox-1.2.24.ebuild,
+  dropbox-1.2.24-r1.ebuild, dropbox-1.2.48.ebuild, +dropbox-1.2.51.ebuild,
+  metadata.xml:
+  Version Bump, #402501, drop a copuple of bundled libs, #400877, drop
+  mprotect() PaX flag, #401467, drop . from DESCRIPTION
+