Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585462 - glsa-check report some package as vulnerable incorrectly
Summary: glsa-check report some package as vulnerable incorrectly
Status: RESOLVED DUPLICATE of bug 575214
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Tools (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Portage Tools Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-09 12:50 UTC by LABBE Corentin
Modified: 2017-01-30 17:28 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description LABBE Corentin 2016-06-09 12:50:59 UTC 
When running glsa-check I got:
glsa-check -t all
This system is affected by the following GLSAs:
201010-01
201603-15
201206-15
For 201010-01 and 201206-15 (libpng), my libpng versions are:
equery l libpng
[IP-] [  ] media-libs/libpng-1.2.56:1.2
[IP-] [  ] media-libs/libpng-1.6.21:0/16
So libpng cannot be vulnerable according to the dump of the glsa
Vulnerable:        <1.5.10
Unaffected:        >=1.5.10, >=~1.2.49, >=~1.2.50, >=~1.2.51, >=~1.2.52, >=~1.2.53, >=~1.2.54, >=~1.2.55


Same for 201603-15(openssl)
[IP-] [  ] dev-libs/openssl-0.9.8z_p8:0.9.8
[IP-] [  ] dev-libs/openssl-1.0.2h:0


Reproducible: Always
Comment 1 Ján Regeš 2017-01-30 10:54:04 UTC 
Hi,

please check this bug. We have a lot of servers in Nagios with glsa-check and it reports vulnerabilities for unaffected packages. So lot of false positives.

Thank you.
Comment 2 Zac Medico gentoo-dev 2017-01-30 17:28:29 UTC 
These GLSAs have had lots of revisions that might have affected glsa-check behavior:

https://gitweb.gentoo.org/data/glsa.git/log/glsa-201010-01.xml
https://gitweb.gentoo.org/data/glsa.git/log/glsa-201206-15.xml

Please file a new bug if you fund incorrect behavior with the latest revisions of GLSAs and the latest version of gentoolkit.

*** This bug has been marked as a duplicate of bug 575214 ***