Vulnerability roundup 85: swftools-0.9.2: 17 advisories [8.8]

[ckauhaus]

search, files

• CVE-2017-8400 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11096 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11097 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11098 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11099 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11100 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-11101 CVSSv3=8.8 (nixos-20.03, nixos-unstable)
• CVE-2017-7698 CVSSv3=7.8 (nixos-20.03, nixos-unstable)
• CVE-2017-16793 CVSSv3=7.8 (nixos-20.03, nixos-unstable)
• CVE-2017-16796 CVSSv3=7.8 (nixos-20.03, nixos-unstable)
• CVE-2017-16797 CVSSv3=7.8 (nixos-20.03, nixos-unstable)
• CVE-2017-10976 CVSSv3=7.5 (nixos-20.03, nixos-unstable)
• CVE-2017-8401 CVSSv3=6.5 (nixos-20.03, nixos-unstable)
• CVE-2017-16711 CVSSv3=5.5 (nixos-20.03, nixos-unstable)
• CVE-2017-16794 CVSSv3=5.5 (nixos-20.03, nixos-unstable)
• CVE-2017-16868 CVSSv3=5.5 (nixos-20.03, nixos-unstable)
• CVE-2017-16890 CVSSv3=5.5 (nixos-20.03, nixos-unstable)

Scanned versions: nixos-20.03: a84b797; nixos-unstable: 22c9881. May contain false positives.

Cc @k0ral

[k0ral]

Possible trajectories:

1. upgrade derivation to latest changeset from upstream github, in case security issues have been fixed there;
2. mark package as insecure so that users have to explicitly set permittedInsecurePackages to build derivation
3. remove derivation altogether from nixpkgs

As I suspect not many people are still using these tools (I personally haven't for a long time, and don't intend to in the future), I'd rather go with 3/ .

[ckauhaus]

Yes, please remove it from nixpkgs. No upstream release since 2013.

[k0ral]

Actually, I cannot just remove swftools as it is a dependency of infoqscraper (nixpkgs ref, upstream ref).
Cc @edwtjo .

[ckauhaus]

@edwtjo would it be feasible to disable flash support in infoqscraper?

[alyssais]

In #118934 I propose marking infoqscraper as broken and swftools as insecure.

[ckauhaus]

Looks like there's nothing left to do here.