#27749 - gnu: heimdal: Update to 7.4.0.

Package	Source(s)		Maintainer(s)
guix-patches		PTS Buildd Popcon

Message #28 received at 27749@debbugs.gnu.org (full text, mbox, reply):

Received: (at 27749) by debbugs.gnu.org; 18 Oct 2017 21:32:07 +0000
From debbugs-submit-bounces@debbugs.gnu.org Wed Oct 18 17:32:07 2017
Received: from localhost ([127.0.0.1]:48772 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1e4vwd-0002ox-Gf
	for submit@debbugs.gnu.org; Wed, 18 Oct 2017 17:32:07 -0400
Received: from sender-of-o51.zoho.com ([135.84.80.216]:21074)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <rekado@elephly.net>) id 1e4vwZ-0002ob-15
 for 27749@debbugs.gnu.org; Wed, 18 Oct 2017 17:32:06 -0400
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1508362300; 
 s=zoho; d=elephly.net; i=rekado@elephly.net;
 h=References:From:To:Cc:Subject:In-reply-to:Date:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding;
 l=1245; bh=8H5s/c3CPPUIqaVV2rr26lvZgIqWEguCguoiUFob3JM=;
 b=gH0i791bvj9jb7XxgDSxBEzi69fDXvK9LT0aZ1U+v5dXkVNzdgEIXXNGQR+5IU2S
 Bjklc+GIoCU5wfX+YtO3hX1ciIX2PwNxK6j0QC6dzpbOElcMERBo7KY4696mraMVgkL
 3o/DoEdJHm85YsEr/0Q2Mqtql2RroWyOFQh7RcLU=
Received: from localhost (port-92-200-55-161.dynamic.qsc.de [92.200.55.161])
 by mx.zohomail.com with SMTPS id 1508362300757716.79591543961;
 Wed, 18 Oct 2017 14:31:40 -0700 (PDT)
References: <87wp76kv68.fsf@gmail.com> <20170718154906.GB16798@jasmine.lan>
 <87bmogzspe.fsf@gmail.com> <877ez4znze.fsf@gmail.com>
 <20170720195134.GA19680@jasmine.lan>
User-agent: mu4e 0.9.18; emacs 25.3.1
From: Ricardo Wurmus <rekado@elephly.net>
To: Alex Vong <alexvong1995@gmail.com>
Subject: Re: [bug#27749] [PATCH] gnu: heimdal: Update to 7.4.0 [fixes
 CVE-2017-11103].
In-reply-to: <20170720195134.GA19680@jasmine.lan>
X-URL: https://elephly.net
X-PGP-Key: https://elephly.net/rekado.pubkey
X-PGP-Fingerprint: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
Date: Wed, 18 Oct 2017 23:31:38 +0200
Message-ID: <871sm03zyd.fsf@elephly.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-ZohoMailClient: External
X-Spam-Score: -2.8 (--)
X-Debbugs-Envelope-To: 27749
Cc: 27749@debbugs.gnu.org, Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -2.8 (--)

Hi Alex,

> On Wed, Jul 19, 2017 at 07:04:53PM +0800, Alex Vong wrote:
>> Here is the updated patch:
>>
>> From 33ae64ead2031e7707639302977d31487e992660 Mon Sep 17 00:00:00 2001
>> From: Alex Vong <alexvong1995@gmail.com>
>> Date: Wed, 19 Jul 2017 17:01:47 +0800
>> Subject: [PATCH] gnu: heimdal: Fix CVE-2017-{6594,11103}.
>>
>> * gnu/packages/patches/heimdal-CVE-2017-6594.patch,
>> gnu/packages/patches/heimdal-CVE-2017-11103.patch: New files.
>> * gnu/local.mk (dist_patch_DATA): Add them.
>> * gnu/packages/kerberos.scm (heimdal)[source]: Use them.
>
> Thanks! I recreated the commit since the patch no longer applied to
> 'gnu/local.mk' and pushed as 81c35029d4ee4fa7cd517998844229a514b35531.
>
> I'm leaving this bug open for now so we can discuss the update.

As mentioned before, the new release bundles a bunch of third party
libraries.  It is not clear to me if *all* things under “lib” are
external libraries or if some of them are part of the source code of
heimdal.

Can we learn from the Debian package for heimdal here?

I think we really ought to update from the very old version we are using
currently.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Mon Dec 30 17:46:22 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#27749 gnu: heimdal: Update to 7.4.0.