-
-
Notifications
You must be signed in to change notification settings - Fork 15.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
keepalived: 1.4.2 -> 1.4.5, patch CVE-2018-19115 #72278
Conversation
I think we should backport patch and version bump here. This is an old enough codebase, surely there is some bugfixes worth shipping in the release. Note that upstream calls for distros updating to 2.x on its homepage :
In our case it would also mean revamping the associated service module. Although it's not a highly complex service, it's probably best done by someone actually using it. |
Re: new maintainer - Absolutely - I was asking around on IRC and |
A start would be to have a nixos test for it so we can easily see if we're breaking the module. |
(cherry picked from commit 03d6145)
/cc @mbrgm, as I see several keepalived bumps from them. I know almost nothing about it; for now I just picked the patch to stables. If "you" feel like it, add more. |
(cherry picked from commit 03d6145)
It's quite some time since I used keepalived on NixOS... and back then, it was only in a test environment, no production usage. PR looks good to me... however, I currently don't have anything in place to properly test the behavior besides running the binary. As @risicle suggested, a NixOS test could prove quite valuable. |
Motivation for this change
Patches https://nvd.nist.gov/vuln/detail/CVE-2018-19115
Also bumped to last release of 1.4.x series. Why not the newer 2.x series? I have never used keepalived and this package has no maintainer listed, so I'm being conservative, not wanting to break anything...
Will probably backport the patch without the bump.
Things done
sandbox
innix.conf
on non-NixOS)nix-shell -p nix-review --run "nix-review wip"
./result/bin/
)nix path-info -S
before and after)Notify maintainers
cc @