| Summary: | <dev-libs/nss-3.49: Multiple Vulnerabilities (CVE-2017-{11695,11696,11697,11698}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Aleksandr Wagner (Kivak) <alwag> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | arthur, mozilla |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://seclists.org/fulldisclosure/2017/Aug/17 | ||
| Whiteboard: | A2 [glsa+ cve] | ||
| Package list: |
dev-libs/nss-3.51
dev-libs/nspr-4.25
|
Runtime testing required: | --- |
|
Description
Aleksandr Wagner (Kivak)
2017-08-11 10:46:13 UTC
Maintainer(s), please advise, this looks like it has gotten lost in Bugzilla, can you please advise if this is fixed? (In reply to Yury German from comment #1) > Maintainer(s), please advise, this looks like it has gotten lost in > Bugzilla, can you please advise if this is fixed? Important comment from Mozilla about the status of this: "I’m sorry this bug didn’t get suitable, timely attention, nor follow-up. This CVE was not tracked in Mozilla’s lists (since the CVE wasn’t allocated by us), and both age and turnover in the NSS team led to it being dropped. This bug and its peers from the 9 Aug 2017 disclosure [0] are all in libnssdbm, which has been replaced by a SQLite datastore, starting in NSS 3.12 in 2008 [1]. In 2018, Firefox 60 and NSS 3.35 made SQLite the default [2], and in Bug 1594931 (Firefox 73) and Bug 1594933 (NSS 3.49) we will stop building this legacy database by default [3][4]. These bugs are real and easily demonstrated, but require local modification of the profile directory, and thus are difficult to exploit widely. The underlying causes are deep within DBM, which was legacy ndbm code even back unto the first commits of NSS in Netscape. Fixing these issues is effectively fixing structual problems with the serialization layer of ndbm from the early 1990s. Unfortunately, these bugs are not shallow. The solution is to move to the SQLite format and leave this deprecated, legacy code until we can remove it entirely in the early 2020s. For that reason, I am closing this and its peer bugs as WONTFIX. As [0] already disclosed the bugs, I am going to open them up as well to explain this publicly." https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9 Added to an existing GLSA. We need to stabilize >=dev0libs/nss-3.49 to ensure that the affected libraries are no longer present. An automated check of this bug failed - repoman reported dependency errors (203 lines truncated):
> dependency.bad dev-libs/nss/nss-3.51.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=dev-libs/nspr-4.25[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_riscv_lp64d(-)?,abi_riscv_lp64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
> dependency.bad dev-libs/nss/nss-3.51.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=dev-libs/nspr-4.25[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_riscv_lp64d(-)?,abi_riscv_lp64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
> dependency.bad dev-libs/nss/nss-3.51.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=dev-libs/nspr-4.25[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_riscv_lp64d(-)?,abi_riscv_lp64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
sparc stable This issue was resolved and addressed in GLSA 202003-37 at https://security.gentoo.org/glsa/202003-37 by GLSA coordinator Thomas Deutschmann (whissi). Re-opening for remaining architectures. Looks like the re-opening comment and glsa+ went to the wrong place, with not even amd64 done here? arm64 stable amd64 stable s390 stable ppc stable ppc64 stable ia64 stable x86 stable hppa stable arm stable. Maintainer(s), please cleanup. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e0cb2ef179d11014b83d4f5547949fcc057b4951 commit e0cb2ef179d11014b83d4f5547949fcc057b4951 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-31 17:48:42 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-31 17:50:38 +0000 dev-libs/nss: security cleanup (#627534) Bug: https://bugs.gentoo.org/627534 Package-Manager: Portage-2.3.96, Repoman-2.3.22 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> dev-libs/nss/Manifest | 5 - dev-libs/nss/files/nss-3.47-enable-pem.patch | 11 - dev-libs/nss/metadata.xml | 1 - dev-libs/nss/nss-3.47.1-r1.ebuild | 375 --------------------------- dev-libs/nss/nss-3.48-r1.ebuild | 375 --------------------------- dev-libs/nss/nss-3.49.2.ebuild | 375 --------------------------- dev-libs/nss/nss-3.50-r1.ebuild | 359 ------------------------- 7 files changed, 1501 deletions(-) Repository is clean, all done! |
