Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libexif: fix CVE-2018-20030 #72958

Merged
merged 1 commit into from Nov 16, 2019
Merged

Conversation

@erictapen
Copy link
Contributor

erictapen commented Nov 7, 2019

Motivation for this change

Close #70104, #57153, #56361.

Things done

Patch for CVE-2018-20030. As the fix in libexif/libexif@6aa11df seems to depend on libexif/libexif@5d28011, I also pulled that commit in. The fix itself alters ./NEWS in the source tree and causes a patch failure when directly applied, so I edited that part out and saved it as ./CVE-2018-20030-2.patch. That is a bit hacky, but the best I could come up with.

Also:

  • Use libexif/libexif@c39acd1 as source for the old CVE-2017-7544.patch. The resulting patch is identical, but comes in a different format. Therefore we can skip the patchFlags.

  • Update the website, as http://libexif.sourceforge.net/ shows only a move notice.

  • Add erictapen as maintainer.

This needs to be backported to release-19.09.

  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
Notify maintainers

cc @

Also:

- Use GitHub as source for CVE-2017-7544.patch [0]. The resulting patch
  is identical, but comes in a different format.

- Update the website, as http://libexif.sourceforge.net/ shows only a
  move notice.

- Add erictapen as maintainer.

[0] libexif/libexif@c39acd1
@vcunat
vcunat approved these changes Nov 16, 2019
vcunat added a commit that referenced this pull request Nov 16, 2019
@vcunat

This comment has been minimized.

Copy link
Member

vcunat commented Nov 16, 2019

Next-time inspiration: 233f363.

@vcunat vcunat merged commit 6310531 into NixOS:master Nov 16, 2019
15 checks passed
15 checks passed
Evaluation Performance Report Evaluator Performance Report
Details
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-maintainers matching changed paths to changed attrs...
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-darwin nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A darwin-tested
Details
grahamcofborg-eval-nixos nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release-combined.nix -A tested
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A manual
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A options
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A manual
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A tarball
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A unstable
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
libexif on aarch64-linux Success
Details
libexif on x86_64-linux Success
Details
vcunat added a commit that referenced this pull request Nov 16, 2019
(cherry picked from commit 908f624)
Fixes #70104.
vcunat added a commit that referenced this pull request Nov 16, 2019
(cherry picked from commit 908f624)
Fixes #57153.
@erictapen

This comment has been minimized.

Copy link
Contributor Author

erictapen commented Nov 16, 2019

@vcunat Ah nice! I looked at the fetchpatch code but for some reason missed the excludes part.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.