| Summary: | <net-dns/libidn2-2.2.0: multiple vulnerabilities (CVE-2019-{18224,12290}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Jeroen Roovers (RETIRED) <jer> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | Flags: | stable-bot:
sanity-check+
|
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de | ||
| Whiteboard: | A2 [glsa+ cve] | ||
| Package list: |
=net-dns/libidn2-2.3.0
|
Runtime testing required: | --- |
|
Description
Jeroen Roovers (RETIRED)
2019-10-15 08:34:49 UTC
@ maintainer(s): How about rev bumping and adding https://gitlab.com/fweimer/libidn2/commit/fdd3b791c23d366c89264b15b50aeb5bb98ad1ce ? (In reply to Jeroen Roovers from comment #0) > > The solution might be to stabilise 2.2.0 but [2] suggests that the SONAME > might need to be bumped because _idn2_punycode_decode was removed, or some > symbols might need to be reinstated (this happens a lot with libidn/libidn2). > That part is fixed in 2.3.0, so we should probably go for 2.3.0 instead. Has also the advantage of Unicode 11, bringing libidn2 back in step with glibc, and of fixing the related failures in the glibc test suite. (In reply to Andreas K. Hüttel from comment #2) > (In reply to Jeroen Roovers from comment #0) > > > > The solution might be to stabilise 2.2.0 but [2] suggests that the SONAME > > might need to be bumped because _idn2_punycode_decode was removed, or some > > symbols might need to be reinstated (this happens a lot with libidn/libidn2). > > > > That part is fixed in 2.3.0, so we should probably go for 2.3.0 instead. Yes, hence the change dated 2019-11-14... arm64 stable hppa/sparc stable amd64 stable arm stable s390 stable ppc stable ppc64 stable ia64 stable x86 stable SuperH port disbanded. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=587cf62ba1aa7f20122547ae627532e544a91168 commit 587cf62ba1aa7f20122547ae627532e544a91168 Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2020-03-29 10:24:58 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2020-03-29 10:25:01 +0000 net-dns/libidn2: destabilize down to ~m68k Bug: https://bugs.gentoo.org/697752 Package-Manager: Portage-2.3.96, Repoman-2.3.22 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> net-dns/libidn2/libidn2-2.1.1a-r1.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Destabilized down to ~m68k. @maintainer(s), please cleanup The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5973465138e4612bffbc5f71285dc0e403f3c2f7 commit 5973465138e4612bffbc5f71285dc0e403f3c2f7 Author: Jeroen Roovers <jer@gentoo.org> AuthorDate: 2020-03-30 04:03:08 +0000 Commit: Jeroen Roovers <jer@gentoo.org> CommitDate: 2020-03-30 04:03:29 +0000 net-dns/libidn2: Old Package-Manager: Portage-2.3.96, Repoman-2.3.22 Bug: https://bugs.gentoo.org/show_bug.cgi?id=697752 Signed-off-by: Jeroen Roovers <jer@gentoo.org> net-dns/libidn2/Manifest | 1 - net-dns/libidn2/libidn2-2.1.1a-r1.ebuild | 53 -------------------------------- 2 files changed, 54 deletions(-) Thanks everyone. Adding CVE-2019-18224. New GLSA request filed. This issue was resolved and addressed in GLSA 202003-63 at https://security.gentoo.org/glsa/202003-63 by GLSA coordinator Thomas Deutschmann (whissi). |
