Bug 777987 – <net-irc/scrollz-2.3.1: ReDoS vulnerability

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2021-03-24 13:59:29 UTC]

From URL:

Impact:

  A malicious irc user could nuke any other irc user that uses bitchx, ircii or
  scrollz out of irc (crash their irc client) by connecting to the same irc
  network and sending a malicious CTCP UTC message.

Solution:

  For ircii: Update to ircii-20210314
  For bitchx and scrollz: none yet


Given bug 776772 it's possible there's other vulnerabilities here too.

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-07-29 17:23:36 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-29 17:31:59 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:39:53 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:48:04 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 18:04:00 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 6 NATTkA bot 2021-07-29 18:12:18 UTC]

Package list is empty or all packages have requested keywords.

[Comment 7 Pascal Jäger 2022-11-16 07:07:49 UTC]

This is fixed in scrollz-2.3.1. 
https://github.com/ScrollZ/ScrollZ/commit/1155969d24e063b6d0b7e08b9b0c4ea8623f92ce
https://github.com/ScrollZ/ScrollZ/commit/fd1e9eb9d7eae82fa923f5bcb83ea099a0fbbb4e

[Comment 8 John Helmert III 2022-11-16 17:17:06 UTC]

Great, thanks! Are scrollz and bitchx forks of ircii?

[Comment 9 Larry the Git Cow 2022-11-22 07:05:49 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=55e4a023b11c654b43cc878ba3be7bc9ee4977e5

commit 55e4a023b11c654b43cc878ba3be7bc9ee4977e5
Author:     Pascal Jäger <[e-mail]>
AuthorDate: 2022-11-15 08:06:33 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-11-22 07:04:02 +0000

    net-irc/scrollz: version bump to 2.3.1, patch for clang16
    
    Version bump also closes this vulnerability from bug 777987.
    
    Bug: https://bugs.gentoo.org/777987
    Closes: https://bugs.gentoo.org/731206
    Closes: https://bugs.gentoo.org/861467
    Closes: https://bugs.gentoo.org/870907
    Signed-off-by: Pascal Jäger <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/28284
    Signed-off-by: Sam James <[e-mail]>

 net-irc/scrollz/Manifest             |  2 ++
 net-irc/scrollz/scrollz-2.3.1.ebuild | 69 ++++++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+)

[Comment 10 John Helmert III 2022-11-22 15:48:45 UTC]

Thanks! Please stabilize when ready.

(In reply to John Helmert III from comment #8)
> Great, thanks! Are scrollz and bitchx forks of ircii?

[Comment 11 Larry the Git Cow 2023-11-09 06:27:28 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=524c415744c035ae2cda5d83b52c892aa335a68a

commit 524c415744c035ae2cda5d83b52c892aa335a68a
Author:     Hans de Graaff <[e-mail]>
AuthorDate: 2023-11-09 06:27:00 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2023-11-09 06:27:24 +0000

    net-irc/scrollz: drop 2.3-r1
    
    Bug: https://bugs.gentoo.org/777987
    Signed-off-by: Hans de Graaff <[e-mail]>

 net-irc/scrollz/Manifest              |  1 -
 net-irc/scrollz/scrollz-2.3-r1.ebuild | 64 -----------------------------------
 2 files changed, 65 deletions(-)