Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

opencv3: 3.4.7 -> 3.4.8, addressing CVE-2019-14491, CVE-2019-14492 & CVE-2019-15939 #72625

Merged
merged 1 commit into from Nov 6, 2019
Merged

opencv3: 3.4.7 -> 3.4.8, addressing CVE-2019-14491, CVE-2019-14492 & CVE-2019-15939 #72625

merged 1 commit into from Nov 6, 2019

Conversation

risicle
Copy link
Contributor

@risicle risicle commented Nov 2, 2019

Motivation for this change

https://nvd.nist.gov/vuln/detail/CVE-2019-14491
https://nvd.nist.gov/vuln/detail/CVE-2019-14492
https://nvd.nist.gov/vuln/detail/CVE-2019-15939

CVE-2019-14492 isn't applicable to the 3.x series.

All internal downloads are unchanged for this release. Aiming this at staging because I don't have the capacity to build all the reverse dependencies, of which there are ~250 by my count.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
Notify maintainers

cc @

@ofborg ofborg bot requested a review from basvandijk November 2, 2019 21:48
@risicle
Copy link
Contributor Author

risicle commented Nov 2, 2019

@GrahamcOfBorg build opencv3 python27Packages.opencv3 python37Packages.opencv3 digikam ekiga opencv3WithoutCuda caffe

@FRidh
Copy link
Member

FRidh commented Nov 3, 2019

Aiming this at staging because I don't have the capacity to build all the reverse dependencies, of which there are ~250 by my count.

Whether you have the capacity to test or not is irrelevant for the target branch. We have to find out one way or another. In this case I suggest to simply target master as its not such a big build and you get faster feedback.

@risicle
Copy link
Contributor Author

risicle commented Nov 3, 2019

Whether you have the capacity to test or not is irrelevant for the target branch.

It's more that I use that as the bellwether to decide if this is a "mass rebuild" or not...

@risicle
opencv3: 3.4.7 -> 3.4.8 (security)
a38ee9f 
addressing CVE-2019-14491, CVE-2019-14492 & CVE-2019-15939

all internal downloads are unchanged for this release
@risicle risicle changed the base branch from staging to master November 3, 2019 12:35
@alyssais alyssais merged commit baa8892 into NixOS:master Nov 6, 2019
@erictapen erictapen mentioned this pull request Nov 6, 2019
Closed
10 tasks
This was referenced Nov 7, 2019
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@basvandijk basvandijk Awaiting requested review from basvandijk

@alyssais alyssais Awaiting requested review from alyssais

@FRidh FRidh Awaiting requested review from FRidh

@jonringer jonringer Awaiting requested review from jonringer

@zimbatm zimbatm Awaiting requested review from zimbatm

Assignees
No one assigned
Labels
1.severity: security 8.has: clean-up 10.rebuild-darwin: 11-100 10.rebuild-linux: 101-500
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@risicle @FRidh @veprbl @alyssais