Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

qt512: patch qtwebengine against CVE-2019-5786 #57526

Merged
merged 1 commit into from Mar 14, 2019
Merged

qt512: patch qtwebengine against CVE-2019-5786 #57526

merged 1 commit into from Mar 14, 2019

Conversation

xantoz
Copy link
Contributor

@xantoz xantoz commented Mar 12, 2019 •
edited

Motivation for this change

qtwebengine is vulnerable to CVE-2019-5786

See: https://codereview.qt-project.org/#/c/255162/

Things done

Took the patch at http://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=43316b15
and modified it so it would apply (only the paths needed to be changed).

  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@xantoz xantoz requested a review from ttuegel as a code owner March 12, 2019 15:59
@xantoz xantoz force-pushed the qtwebengine-fix-CVE-2019-5785 branch from c00f252 to 1485ec4 Compare March 13, 2019 12:08
@xantoz xantoz changed the title qt-5.12: patch qtwebengine against CVE-2019-5786 qt-512: patch qtwebengine against CVE-2019-5786 Mar 13, 2019
@xantoz xantoz changed the title qt-512: patch qtwebengine against CVE-2019-5786 qt512: patch qtwebengine against CVE-2019-5786 Mar 13, 2019
@xantoz xantoz force-pushed the qtwebengine-fix-CVE-2019-5785 branch from 1485ec4 to b62f91e Compare March 13, 2019 12:09
@xantoz
Copy link
Contributor Author

xantoz commented Mar 13, 2019

Changed qt-5.12 in the commit message and PR title to qt512 to match the attribute name.

@andir
Copy link
Member

andir commented Mar 13, 2019

@xantoz thank you for the PR.

It looks like a good thing to fix. Do you have any idea about older versions of QT? I could imagine most of them (that are based of the same engine) have this issue.

We currently have 5.12, 5.11, 5.9, 5.6, 4.8 (and also qt3) in nixpkgs. Checking if the same patch applies to older versions would be good.

@andir andir added 1.severity: security 9.needs: port to stable A PR needs a backport to the stable release. labels Mar 13, 2019
@xantoz
Copy link
Contributor Author

xantoz commented Mar 13, 2019 •
edited

@andir I have checked against 5.11, and the patch does not apply. I haven't been able to find file_reader_loader.cc in there to start with. So backporting this patch to 5.11 and older will take some extra detective work.

With that in mind, I went ahead with only patching 5.12.

@xantoz xantoz force-pushed the qtwebengine-fix-CVE-2019-5785 branch from b62f91e to b22d92f Compare March 13, 2019 21:27
@andir andir merged commit a050cb9 into NixOS:master Mar 14, 2019
@andir
Copy link
Member

andir commented Mar 14, 2019

Ported to 19.03 in e750a2e

@xantoz
Copy link
Contributor Author

xantoz commented Mar 17, 2019

Thanks for the merge.
I'd just like to point out that qt-5.12.2 has been released since, which fixes this and some other bugs/CVEs in qtwebengine: https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.12.2/?h=v5.12.2

@samueldr samueldr removed the 9.needs: port to stable A PR needs a backport to the stable release. label Apr 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ttuegel ttuegel Awaiting requested review from ttuegel ttuegel is a code owner

Assignees
No one assigned
Labels
1.severity: security 6.topic: qt/kde 10.rebuild-darwin: 1-10 10.rebuild-linux: 101-500 12. first-time contribution
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@xantoz @andir @samueldr @GrahamcOfBorg @Janik-Haag