| Summary: | <dev-vcs/fossil-2.16: Client-side TLS Doesn't Verify Hostname (CVE-2021-36377) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Aaron W. Swenson <titanofold> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | IN_PROGRESS --- | ||
| Severity: | minor | Flags: | nattka:
sanity-check+
|
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://fossil-scm.org/forum/forumpost/8d367e16f53d93c789d70bd3bf2c9587227bbd5c6a7b8e512cccd79007536036 | ||
| Whiteboard: | B4 [glsa?] | ||
| Package list: |
dev-vcs/fossil-2.16-r1
|
Runtime testing required: | No |
| Bug Depends on: | 799764 | ||
| Bug Blocks: | |||
|
Description
Aaron W. Swenson
2021-07-05 10:13:11 UTC
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=890a83ca5a2be8f7663757c937ccfe2b349d22fc commit 890a83ca5a2be8f7663757c937ccfe2b349d22fc Author: Aaron W. Swenson <titanofold@gentoo.org> AuthorDate: 2021-07-05 10:13:45 +0000 Commit: Aaron W. Swenson <titanofold@gentoo.org> CommitDate: 2021-07-05 10:13:45 +0000 dev-vcs/fossil: Bump to 2.16 Security: Fix the client-side TLS so that it verifies that the server hostname matches its certificate. Bug: https://bugs.gentoo.org/800638 Signed-off-by: Aaron W. Swenson <titanofold@gentoo.org> dev-vcs/fossil/Manifest | 1 + dev-vcs/fossil/fossil-2.16.ebuild | 75 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) Please stabilize the following target(s): =dev-vcs/fossil-2.16 ~amd64 ~arm ~ppc ~ppc64 ~x86 Sanity check failed:
> dev-vcs/fossil-2.16
> depend arm stable profile default/linux/arm/17.0 (1 total)
> >=dev-db/sqlite-3.35.0:3
> depend arm dev profile default/linux/arm/17.0/armv4 (35 total)
> >=dev-db/sqlite-3.35.0:3
> rdepend arm stable profile default/linux/arm/17.0 (1 total)
> >=dev-db/sqlite-3.35.0:3
> rdepend arm dev profile default/linux/arm/17.0/armv4 (35 total)
> >=dev-db/sqlite-3.35.0:3
I guess we're blocked on sqlite stabilization for arm. All sanity-check issues have been resolved Unable to check for sanity:
> no match for package: dev-vcs/fossil-2.16
Missed a couple fixes introduced in previous commits. use binding := for dev-libs/openssl in commit 12b8e1427c7b1b79a5f05f779c05f1c0dc1244d1 and fix BadDefaultUseFlags commit 74b6fd7b43d1233e481f394f3bacce23475de724. So, please stabilize the following target(s): =dev-vcs/fossil-2.16-r1 ~amd64 ~arm ~ppc ~ppc64 ~x86 All sanity-check issues have been resolved amd64 stable ppc stable ppc64 stable x86 stable Unable to check for sanity:
> dependent bug #799764 is missing keywords
All sanity-check issues have been resolved arm done all arches done Please cleanup, thanks! The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7624be2cf739bb836403346f4e690cb8f56be65a commit 7624be2cf739bb836403346f4e690cb8f56be65a Author: Aaron W. Swenson <titanofold@gentoo.org> AuthorDate: 2021-07-17 15:06:04 +0000 Commit: Aaron W. Swenson <titanofold@gentoo.org> CommitDate: 2021-07-17 15:06:04 +0000 dev-vcs/fossil: Cleanup Bug: https://bugs.gentoo.org/800638 Signed-off-by: Aaron W. Swenson <titanofold@gentoo.org> dev-vcs/fossil/Manifest | 3 -- dev-vcs/fossil/fossil-2.12.1-r1.ebuild | 71 ---------------------------------- dev-vcs/fossil/fossil-2.13-r1.ebuild | 71 ---------------------------------- dev-vcs/fossil/fossil-2.14-r1.ebuild | 71 ---------------------------------- 4 files changed, 216 deletions(-) No glsa for a year, cleanup done. Suggest to mark as resolved. (In reply to 9ts641j2 from comment #18) > No glsa for a year, cleanup done. Suggest to mark as resolved. We're aware of the backlog with some of these but commenting on them isn't going to help the situation -- we're nearly there with the new GLSA tooling. |
