libav: mark as insecure #111330

dotlambda · 2021-01-30T17:36:29Z

Motivation for this change

closes #90844 and closes #90852 and closes #90839
I didn't list all vulnerabilities under knownVulnerabilities.

Consequences of this change

This disables the following packages:

7 packages removed:
clickshare-csc1 (†01.07.00.033) keyfinder (†2.2) libav (†0.8.21) libav (†11.12) libav (†12.3) vdr-markad (†2017-03-13) vdr-xineliboutput (†2.2.0)

~~Is there a way to make ofborg ping their maintainers?~~

For those maintainers: Consider switching to ffmpeg.

erictapen · 2021-01-30T17:40:49Z

Thats a lot of packages to break. Why don't we patch for the vulnerabilities?

dotlambda · 2021-01-30T18:01:35Z

Thats a lot of packages to break. Why don't we patch for the vulnerabilities?

I guess we could find some patches over at ffmpeg, but wouldn't it be easier to patch everything to use ffmpeg instead?

vcunat · 2021-01-30T18:02:49Z

I'm not aware of a way to notify them. steam* is certainly used; I'm not sure how important libav is in there and perhaps ffmpeg is perfectly OK.

dotlambda · 2021-01-30T18:34:22Z

@jtojnar @IvarWithoutBones @prusnak Libav is not in https://github.com/AppImage/pkg2appimage/blob/master/excludelist. Should we just remove it from appimageTools's dependencies or replace it by ffmpeg?

dotlambda · 2021-01-30T19:17:40Z

Thats a lot of packages to break.

We brought the number down from 74 to 7.

rycee · 2021-01-30T20:07:03Z

Checked the unpaper change and it is OK. Thanks!

twhitehead · 2021-01-31T04:26:38Z

My only experience is with the ovito package. I changed libav in the buildInputs to ffmpeg and it built fine, so certainly seems worthwhile trying the same with any of these other packages that people may be using.

twhitehead

That's a huge list of CVEs with no hope of being fixed upstream. With ffmpeg being pretty much a drop in replacement, makes sense to start the process of phasing out its usage.

twhitehead · 2021-01-31T17:05:54Z

pkgs/development/libraries/libav/default.nix

+        lib.optional (lib.versionOlder version "12.1") "CVE-2017-9051"
+        ++ lib.optionals (lib.versionOlder version "12.3") [ "CVE-2018-5684" "CVE-2018-5766" ]
+        ++ lib.optionals (lib.versionOlder version "12.4") [ "CVE-2019-9717" "CVE-2019-9720" ];


The complete list from the links you provided is

CVE-2014-5271
CVE-2015-3395
CVE-2015-5479
CVE-2016-3062
CVE-2016-6832
CVE-2016-7393
CVE-2016-7424
CVE-2016-8675
CVE-2016-8676
CVE-2017-16803
CVE-2017-9051
CVE-2018-11102
CVE-2018-11224
CVE-2018-18826
CVE-2018-18827
CVE-2018-18828
CVE-2018-18829
CVE-2018-19128
CVE-2018-19129
CVE-2018-19130
CVE-2018-20001
CVE-2018-5684
CVE-2018-5766
CVE-2019-14371
CVE-2019-14372
CVE-2019-14441
CVE-2019-14442
CVE-2019-14443
CVE-2019-9717
CVE-2019-9719
CVE-2019-9720

Definitely makes the case that this package should be gone. I guess the thinking then is it isn't really worth the time to lay these all out? I'm okay with that.

dotlambda · 2021-01-31T17:21:25Z

Alternative suggestion: Just use libav as an alias for ffmpeg and drop the expressions for libav. This will cause some packages not to build which should also catch the maintainers' attention.

dotlambda · 2021-01-31T17:26:52Z

@erikarvstedt @peti @romildo Can we make untrunc an alias of untrunc-anthwlock?

romildo · 2021-02-01T12:41:05Z

@erikarvstedt @peti @romildo Can we make untrunc an alias of untrunc-anthwlock?

It is ok for me. untrunc-anthwlock has more features than untrunc.

The latter has more features and doesn't depend on an outdated version of libav.

WolfangAukang · 2021-02-03T00:40:20Z

#111693 for signumone-ks. Removing libav_0_8

yaroot · 2021-02-03T03:06:35Z

@dotlambda I don't think zulu should depend on libav or ffmpeg, I've checked all the so files it should be fine to remove them.

ajs124 · 2021-02-03T14:26:23Z

pkgs/top-level/aliases.nix

@@ -294,6 +294,7 @@ mapAliases ({
  kinetic-cpp-client = throw "kinetic-cpp-client has been removed from nixpkgs, as it's abandoned."; # 2020-04-28
  kicad-with-packages3d = kicad; # added 2019-11-25
  krename-qt5 = krename; # added 2017-02-18
+  keyfinder = throw "keyfinder has been removed because it was broken"; # added 2021-02-01


It seems to work for someone #18475 (comment)

False positive: #18475 (comment) ;-)

@ajs124 Or would say we should keep it anyway? It would defiitely be marked as insecure.

Instead of removing it, I now added a commit updating it to version 2.4.

Yarny0 · 2021-02-04T17:34:09Z

Thanks for the notification about clickshare-csc1. Sadly, clickshare won't build with ffmpeg: It needs libswscale.so.2 which is not provided by any of the ffmpeg versions currently in nixpkgs. I suspect it would need a much older ffmpeg version which we no longer package. Sadly, there is no hope for an update of clickshare as the company no longer produces a linux version.

As long as libav_0_8 isn't removed from nixpkgs, it's probably best to leave clickshare as it is. Users are warned about the situation and can decide themselves if they accept the risk of installing a vulnerable package. I don't know of any other solution.

dotlambda · 2021-02-05T13:23:56Z

Is anything preventing us from merging?

dotlambda · 2021-02-08T13:14:31Z

backport: #112396

dotlambda added 1.severity: security 9.needs: port to stable A PR needs a backport to the stable release. labels Jan 30, 2021

dotlambda requested review from twhitehead and vcunat January 30, 2021 17:36

ofborg bot added 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Jan 30, 2021

ofborg bot added 10.rebuild-linux: 1-10 10.rebuild-linux: 11-100 and removed 10.rebuild-linux: 0 10.rebuild-linux: 1-10 labels Jan 30, 2021

ofborg bot requested a review from rycee January 30, 2021 19:10

ofborg bot added 10.rebuild-darwin: 1-10 and removed 10.rebuild-darwin: 0 labels Jan 30, 2021

ofborg bot requested a review from alkeryn January 30, 2021 19:25

ofborg bot requested review from ggPeti and fpletz January 30, 2021 20:17

twhitehead approved these changes Jan 31, 2021

View reviewed changes

bbjubjub2494 mentioned this pull request Feb 1, 2021

oraclejdk8: remove dependency on libav #111528

Merged

10 tasks

ofborg bot added the 8.has: clean-up label Feb 1, 2021

ofborg bot requested a review from astsmtl February 1, 2021 13:25

dotlambda added 8 commits February 2, 2021 17:26

sdrangel: use ffmpeg instead of libav

7acbde9

musly: use ffmpeg instead of libav

fc8a442

performous: use ffmpeg instead of libav

872b763

electricsheep: use ffmpeg instead of libav

cc92cab

untrunc: make alias of untrunc-anthwlock

a4db899

The latter has more features and doesn't depend on an outdated version of libav.

guitarix: does not depend on libav

68169c8

jabref: does not depend on libav

8139e56

libgroove: use ffmpeg_3 instead of libav

0de5ec9

dotlambda force-pushed the libav-insecure branch from a487189 to d4c07d6 Compare February 2, 2021 16:27

WolfangAukang mentioned this pull request Feb 3, 2021

signumone-ks: removing libav_0_8 #111693

Merged

10 tasks

ajs124 reviewed Feb 3, 2021

View reviewed changes

dotlambda added 7 commits February 4, 2021 15:19

steam-run-native: use ffmpeg instead of libav

83e82c1

graalvm*-ee: remove unused argument libav_0_8

3673ad8

gerbera: don't pass pkgs as argument

013953c

gerbera: use ffmpeg instead of libav

9cba0bb

zulu8: does not depend on libav

564d498

zulu: does not depend on libav

6c478b9

keyfinder: 2.2 -> 2.4

8484b0b

dotlambda force-pushed the libav-insecure branch from 7feef30 to 8484b0b Compare February 4, 2021 14:30

wamserma mentioned this pull request Feb 5, 2021

jabref: add xdg_utils to runtime deps #112028

Closed

9 tasks

ggPeti approved these changes Feb 5, 2021

View reviewed changes

dotlambda merged commit 9a200f6 into NixOS:master Feb 8, 2021

dotlambda deleted the libav-insecure branch February 8, 2021 11:18

TredwellGit added 8.has: port to stable A PR already has a backport to the stable release. and removed 9.needs: port to stable A PR needs a backport to the stable release. labels Aug 20, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libav: mark as insecure #111330

libav: mark as insecure #111330

dotlambda commented Jan 30, 2021 •

edited

erictapen commented Jan 30, 2021

dotlambda commented Jan 30, 2021

vcunat commented Jan 30, 2021

dotlambda commented Jan 30, 2021

dotlambda commented Jan 30, 2021 •

edited

rycee commented Jan 30, 2021

twhitehead commented Jan 31, 2021

twhitehead left a comment

twhitehead Jan 31, 2021

dotlambda commented Jan 31, 2021

dotlambda commented Jan 31, 2021

romildo commented Feb 1, 2021

WolfangAukang commented Feb 3, 2021

yaroot commented Feb 3, 2021

ajs124 Feb 3, 2021

dotlambda Feb 3, 2021

dotlambda Feb 4, 2021

dotlambda Feb 4, 2021

Yarny0 commented Feb 4, 2021

dotlambda commented Feb 5, 2021

dotlambda commented Feb 8, 2021

libav: mark as insecure #111330

libav: mark as insecure #111330

Conversation

dotlambda commented Jan 30, 2021 • edited

Motivation for this change

Consequences of this change

erictapen commented Jan 30, 2021

dotlambda commented Jan 30, 2021

vcunat commented Jan 30, 2021

dotlambda commented Jan 30, 2021

dotlambda commented Jan 30, 2021 • edited

rycee commented Jan 30, 2021

twhitehead commented Jan 31, 2021

twhitehead left a comment

Choose a reason for hiding this comment

twhitehead Jan 31, 2021

Choose a reason for hiding this comment

dotlambda commented Jan 31, 2021

dotlambda commented Jan 31, 2021

romildo commented Feb 1, 2021

WolfangAukang commented Feb 3, 2021

yaroot commented Feb 3, 2021

ajs124 Feb 3, 2021

Choose a reason for hiding this comment

dotlambda Feb 3, 2021

Choose a reason for hiding this comment

dotlambda Feb 4, 2021

Choose a reason for hiding this comment

dotlambda Feb 4, 2021

Choose a reason for hiding this comment

Yarny0 commented Feb 4, 2021

dotlambda commented Feb 5, 2021

dotlambda commented Feb 8, 2021

dotlambda commented Jan 30, 2021 •

edited

dotlambda commented Jan 30, 2021 •

edited