Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

weechat: 2.7 -> 2.7.1 #80672

Merged
merged 1 commit into from Feb 20, 2020
Merged

weechat: 2.7 -> 2.7.1 #80672

merged 1 commit into from Feb 20, 2020

Conversation

mweinelt
Copy link
Member

Motivation for this change
irc: fix crash when receiving a malformed message 352 (who)
irc: fix crash when a new message 005 is received with longer nick prefixes
irc: fix crash when receiving a malformed message 324 (channel mode) (CVE-2020-8955)

https://github.com/weechat/weechat/releases/tag/v2.7.1

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@andir @flokli @lovek323 @the-kenny @lheckemann @Ma27

@mweinelt
weechat: 2.7 -> 2.7.1
2d77fc3 
Release notes:

irc: fix crash when receiving a malformed message 352 (who)
irc: fix crash when a new message 005 is received with longer nick prefixes
irc: fix crash when receiving a malformed message 324 (channel mode) (CVE-2020-8955)
This was referenced Feb 20, 2020
Merged
Merged
lsix
lsix approved these changes Feb 20, 2020
View reviewed changes
Copy link
Member

@lsix lsix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Built and tested. All fine for me.

Security fixes should be backported to release-19.09:

See https://weechat.org/doc/security/

@mweinelt
Copy link
Member Author

Opened #80673 and #80675.

@lsix
Copy link
Member

lsix commented Feb 20, 2020

@mweinelt Yes I saw thew after finishing my review 😅

We should probably check if it is possible to backport security fixes to 2.6 on release-19.09 (policy is usually to try to maintain the main version in stable releases)

@andir
Copy link
Member

andir commented Feb 20, 2020

Unless upstream provides security fixes for the older version we should try to avoid maintaining custom patch sets. Those will likely be incomplete since we lack the complete picture. I think that has also been done in the past unless there was some real breakage that wouldn't be acceptable.

In the past weechat upgrades weren't that intrusive but only the changelog / git log can tell that.

@mweinelt
Copy link
Member Author

There is no branch for the 2.6 release, so I don't think they're patching older versions.

@lsix
Copy link
Member

lsix commented Feb 20, 2020

I was just checking if the commits the refer to (https://weechat.org/doc/security/) are trivially applicable (they are not). Then no problem porting the update to 19.09 !

@andir
Copy link
Member

andir commented Feb 20, 2020

Just make sure to mention those CVEs in the backports. Makes it easier to discover. I'd also like them in the commit messages for each of the changes. Git log will be forever. GitHub might go away :-)

@mweinelt
Copy link
Member Author

The one CVE is part of the commit message, here and in the backports.

@andir andir merged commit d1c61f8 into NixOS:master Feb 20, 2020
@mweinelt mweinelt deleted the pr/weechat/2.7.1 branch February 20, 2020 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andir andir andir approved these changes

@lsix lsix lsix approved these changes

@the-kenny the-kenny Awaiting requested review from the-kenny

@lovek323 lovek323 Awaiting requested review from lovek323

@Ma27 Ma27 Awaiting requested review from Ma27

@lheckemann lheckemann Awaiting requested review from lheckemann

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@mweinelt @lsix @andir