Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 545048 - net-im/prosody-0.9.8 version bump (for added security regarding libidn vulnerability CVE-2015-2059)
Summary: net-im/prosody-0.9.8 version bump (for added security regarding libidn vulner...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Tobias Klausmann (RETIRED)
URL: http://blog.prosody.im/prosody-0-9-8-...
Whiteboard:
Keywords:
: 545552 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-03-30 10:17 UTC by Daniel Kenzelmann
Modified: 2016-10-15 13:56 UTC (History)
7 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Kenzelmann 2015-03-30 10:17:14 UTC 
Prosody 0.9.8 was released including an important security fix:


Ensure only valid UTF-8 is passed to libidn. It was found (CVE-2015-2059) that libidn can read beyond the boundaries of the provided buffer when an input string contains invalid UTF-8 sequences.


Reproducible: Always
Comment 1 Agostino Sarubbo gentoo-dev 2015-03-30 10:34:54 UTC 
our prosody uses system libidn, so I guess this is a duplicate of 541970

*** This bug has been marked as a duplicate of bug 541970 ***
Comment 2 Daniel Kenzelmann 2015-03-30 10:36:50 UTC 
There are other fixes as well in that version, so maybe just change it to a version bump then?
Comment 3 Agostino Sarubbo gentoo-dev 2015-03-30 10:38:54 UTC 
CC'ing maintainers to be sure that my observation is right.
Comment 4 Tobias Klausmann (RETIRED) gentoo-dev 2015-03-30 12:40:48 UTC 
(In reply to Agostino Sarubbo from comment #3)
> CC'ing maintainers to be sure that my observation is right.

That is correct, Prosody uses the system libidn:

$ ldd /usr/lib64/prosody/util/encodings.so
ldd: warning: you do not have execution permission for `/usr/lib64/prosody/util/encodings.so'
        linux-vdso.so.1 (0x00007ffeddd81000)
        libidn.so.11 => /usr/lib64/libidn.so.11 (0x00007fb4c7142000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fb4c6da5000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fb4c758b000)


Switching this to a version bump.
Comment 5 Tobias Klausmann (RETIRED) gentoo-dev 2015-03-30 13:22:18 UTC 
Added 0.9.8 to the tree. Will file stabilization bug in 30 days.
Comment 6 Ronny Boesger 2015-03-30 20:36:38 UTC 
Is this DEPEND for openssl really wanted:

DEPEND="net-im/jabber-base
                [...]
                dev-libs/openssl:0.9.8"


This pulls in dev-lib/openssl:0.9.8 in a new slot (i use a newer version)

The 0.9.7 ebuild ov prosody uses  ">=dev-libs/openssl-0.9.8"
Comment 7 Tobias Klausmann (RETIRED) gentoo-dev 2015-03-31 07:37:15 UTC 
(In reply to Ronny Boesger from comment #6)
> Is this DEPEND for openssl really wanted:
> 
> DEPEND="net-im/jabber-base
>                 [...]
>                 dev-libs/openssl:0.9.8"
> 
> 
> This pulls in dev-lib/openssl:0.9.8 in a new slot (i use a newer version)
> 
> The 0.9.7 ebuild ov prosody uses  ">=dev-libs/openssl-0.9.8"

My bad. Fixed it to require dev-libs/openssl:=
Comment 8 Alexander Tsoy 2015-03-31 13:50:32 UTC 
(In reply to Tobias Klausmann from comment #7)
This is not correct. See bug 545156
Comment 9 Tobias Klausmann (RETIRED) gentoo-dev 2015-04-30 13:53:37 UTC 
*** Bug 545552 has been marked as a duplicate of this bug. ***