#70113 - [PATCH 1/1] gnu: libarchive: Fix a potential security issue.

Package	Source(s)		Maintainer(s)
guix-patches		PTS Buildd Popcon

Message #16 received at 70113@debbugs.gnu.org (full text, mbox, reply):

Received: (at 70113) by debbugs.gnu.org; 2 Apr 2024 13:24:26 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Apr 02 09:24:25 2024
Received: from localhost ([127.0.0.1]:53076 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1rre7l-00082S-Eh
	for submit@debbugs.gnu.org; Tue, 02 Apr 2024 09:24:25 -0400
Received: from mail-wr1-x42e.google.com ([2a00:1450:4864:20::42e]:52449)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <efraim.flashner@gmail.com>)
 id 1rre7d-00081J-2t; Tue, 02 Apr 2024 09:24:20 -0400
Received: by mail-wr1-x42e.google.com with SMTP id
 ffacd0b85a97d-341b01dbebbso4610890f8f.0; 
 Tue, 02 Apr 2024 06:24:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1712064247; x=1712669047; darn=debbugs.gnu.org;
 h=in-reply-to:content-disposition:mime-version:references
 :mail-followup-to:message-id:subject:cc:to:from:date:sender:from:to
 :cc:subject:date:message-id:reply-to;
 bh=oUFcSpezYgZpqQ0GI5BT4QqXxoObOd2AHyQOT1B92U8=;
 b=MMXbeGdYxVMgD3xHlGeu4VGakEBOOfufdF8m5BtGzywX3edqqge/qqsGv6ZhCRlduw
 1GT1WzaIuO0EQJ5Sho/cRI8GFhVVNrHNbIKXwNnXgRhXoeopsqoOaqc04FO+dtX1qZft
 YNNQqQlIE5bdPH9lyWIrFZvpno9yuG6mOlCCeg/STq5g1O7vNNx2SyAzA3UwWtMYrpw5
 jufjvLd7JF0GHvaDPmavDi+PabNlq+pQSnPK4vJ3xPOx78q47TA80lTAemqcgB4dCNef
 4RJXXo8kIMGvWI3LiEroF8p2k8eAugeF0NFL8/pY0RJS7v1JbUJO39o7ag9bzL8y4MBC
 PnTg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1712064247; x=1712669047;
 h=in-reply-to:content-disposition:mime-version:references
 :mail-followup-to:message-id:subject:cc:to:from:date:sender
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=oUFcSpezYgZpqQ0GI5BT4QqXxoObOd2AHyQOT1B92U8=;
 b=MU4jxH92qZz4qoAq2hvmUq9iUZHsC5zsb29CxxQsKWWTC65bmTPNenx3Xwne+h2+JI
 uDLGAng9z7Eg/BOP4c37CcuTqTLGb4FYcYTa7kwsbyk/TISDE2BW74IKzSB2BxutqqIo
 hshKDcCcrGJ6rOGt4qF2pjJX7s+n+jgWLy7O5v3AiiKYJvucIvwy0WjXX7OQcHcdF9Uc
 7TbHW3p+EbDR6PHyq7F4xlsUbphvC9JqU3tvM2GuKMpPP+IJAWM7w7jdINNfBLh75EwX
 LsMy359t2XuRVfe2KS/ew7w1D0KRojerzsZek/rrOtLB9UQ26l8YMeeviutQy9vIjoth
 7Mzg==
X-Forwarded-Encrypted: i=1;
 AJvYcCXymlFo5zjX6BCkPTKQ7XymIetMMEc8+aoMzaZJAWYAFvnqrQ8XC/u4skP5ZmQUNEfv/IE6MQnzvBMdFX7gRYHMX6ZdGSfKaxRzb6VyGHnxFWAqhpGqRr6mtFppsg==
X-Gm-Message-State: AOJu0YxSClAb0O2QH3PsEDpqtBy6Ilpm/oaQtZwaN5K3iWhabeeOF8zf
 B7uFPdXOyCZld2yCZkFMS+bb5KQ3yn4JwRj8HzGXHspoSzEjfZd5
X-Google-Smtp-Source: AGHT+IGI9r7LBhPA6b6rHTCclQPNcdEcHjzt25wVpaw3pIRQJKBFqQDdORWQ6Ux9YsT+etYLRQzLug==
X-Received: by 2002:a5d:4950:0:b0:33d:dcd4:9d8f with SMTP id
 r16-20020a5d4950000000b0033ddcd49d8fmr1357094wrs.65.1712064246770; 
 Tue, 02 Apr 2024 06:24:06 -0700 (PDT)
Received: from localhost ([141.226.12.177]) by smtp.gmail.com with ESMTPSA id
 di6-20020a0560000ac600b00341c9956dc9sm14206240wrb.68.2024.04.02.06.24.05
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Tue, 02 Apr 2024 06:24:06 -0700 (PDT)
Date: Tue, 2 Apr 2024 16:24:04 +0300
From: Efraim Flashner <efraim@flashner.co.il>
To: John Kehayias <john.kehayias@protonmail.com>
Subject: Re: [bug#70113] [PATCH 1/1] gnu: libarchive: Fix a potential
 security issue.
Message-ID: <ZgwG9F56NpS1YGt-@3900XT>
Mail-Followup-To: Efraim Flashner <efraim@flashner.co.il>,
 John Kehayias <john.kehayias@protonmail.com>,
 Leo Famulari <leo@famulari.name>, 70114@debbugs.gnu.org,
 70113@debbugs.gnu.org
References: <7a74261a419e9127887bc9ea096294e42156cce1.1711917891.git.leo@famulari.name>
 <87il10wipx.fsf@protonmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature"; boundary="Cm1u5KeWiQn8tqIz"
Content-Disposition: inline
In-Reply-To: <87il10wipx.fsf@protonmail.com>
X-PGP-Key-ID: 0x41AAE7DCCA3D8351
X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc
X-PGP-Fingerprint: A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
X-Spam-Score: 0.3 (/)
X-Debbugs-Envelope-To: 70113
Cc: 70114@debbugs.gnu.org, 70113@debbugs.gnu.org,
 Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.7 (/)

[Message part 1 (text/plain, inline)]

On Tue, Apr 02, 2024 at 03:23:44AM +0000, John Kehayias via Guix-patches via wrote:
> Hi Leo,
> 
> On Sun, Mar 31, 2024 at 04:44 PM, Leo Famulari wrote:
> 
> > https://github.com/libarchive/libarchive/pull/2101
> >
> > * gnu/packages/backup.scm (libarchive)[replacement]: New field.
> > (libarchive/fixed): New variable.
> > * gnu/packages/patches/libarchive-remove-potential-backdoor.patch: New file.
> > * gnu/local.mk (dist_patch_DATA): Add it.
> >
> 
> Overall changes look good, but I have not had a chance to try it locally
> (building or dependents).
> 

This looks like what I was going to suggest

> [...]
> 
> > +(define-public libarchive/fixed
> > +  (package
> > +    (inherit libarchive)
> > +    (version "3.6.1")
> > +    (source
> > +     (origin
> > +       (method url-fetch)
> > +       (uri (list (string-append "https://libarchive.org/downloads/libarchive-"
> > +                                 version ".tar.xz")
> > +                  (string-append "https://github.com/libarchive/libarchive"
> > +                                 "/releases/download/v" version "/libarchive-"
> > +                                 version ".tar.xz")))
> 
> In light of the xz backdoor, perhaps we should just do a git checkout of
> the v3.6.1 tag rather than the tarballs? Assuming that works, of course.

In this case it was just the patch which didn't do (just) what the
commit message said. IMO applying this patch will make us safe from this
potential JiaT75 backdoor, no bootstrapping from source needed.

> I haven't had a chance to look at potential ABI changes, but perhaps at
> least v3.6.2 is graftable? That also lists a security update (as well as
> later versions).
> 
> Or, if it is easier and this is tested on your end, let's push this and
> do an upgrade to the latest on a branch. I would volunteer mesa-updates,
> but Cuirass has been stuck all day not building anything, so I don't
> know what will end up being quickest (which branch or a new one).

If it turns out that we need to move forward a bit to guard against
other CVEs then this patch should be forward compatible, considering it
was just added to the libarchive repository.

> Thanks for the quick work!
> John

Indeed. Thanks!

-- 
Efraim Flashner   <efraim@flashner.co.il>   רנשלפ םירפא
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 07:31:07 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#70113 [PATCH 1/1] gnu: libarchive: Fix a potential security issue.