Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[r19.03] libvirt: add patches for CVE-2019-10132, CVE-2019-10161, CVE-2019-10166, CVE-2019-10167 & CVE-2019-10168 #63909

Merged
merged 1 commit into from Jun 30, 2019
Merged

[r19.03] libvirt: add patches for CVE-2019-10132, CVE-2019-10161, CVE-2019-10166, CVE-2019-10167 & CVE-2019-10168 #63909

merged 1 commit into from Jun 30, 2019

Conversation

risicle
Copy link
Contributor

@risicle risicle commented Jun 28, 2019

Motivation for this change

Yes, this is indeed every 4.10 commit in the repo after the 4.10.0 release - they don't seem to be in a hurry to release 4.10.1. The fix for CVE-2019-10161 unfortunately breaks the darwin build for me (tested on macos 10.13), so at least having them as separate patches allows me to disable that patch for darwin. I'll open an upstream bug on that once I've also updated/patched master.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@risicle risicle changed the title libvirt: add patches for CVE-2019-10132, CVE-2019-10161, CVE-2019-10166, CVE-2019-10167 & CVE-2019-10168 [r19.03] libvirt: add patches for CVE-2019-10132, CVE-2019-10161, CVE-2019-10166, CVE-2019-10167 & CVE-2019-10168 Jun 28, 2019
@alyssais
Copy link
Member

Is this a backport of a fix in unstable?

@risicle
Copy link
Contributor Author

risicle commented Jun 28, 2019

No, the fix is not in unstable yet - I'm just starting work on that now. I started work on 19.03 first because #61011 was not at that point merged. Upstream have done the backporting themselves, but not yet released the fixed versions.

@ofborg ofborg bot requested a review from fpletz June 28, 2019 23:17
@alyssais
Copy link
Member

Oh, I see — in unstable we can just update to the latest release, but in stable we have to just take the patches?

@alyssais
Copy link
Member

Does the Darwin build failure happen outside of Nixpkgs? Is upstream aware of it if so?

@risicle
Copy link
Contributor Author

risicle commented Jun 28, 2019

They haven't even done the release for the unstable version yet (which will presumably be 5.4.1?)

@alyssais
Copy link
Member

Doesn’t mean they shouldn’t be aware of the bug.

If we’re not going to include a CVE patch because of a bug, I think upstream should at least know about it.

@risicle
Copy link
Contributor Author

risicle commented Jun 29, 2019

This is why I said

I'll open an upstream bug on that once I've also updated/patched master.

@risicle risicle mentioned this pull request Jun 29, 2019
Merged
10 tasks
@risicle
Copy link
Contributor Author

risicle commented Jun 29, 2019

https://bugzilla.redhat.com/show_bug.cgi?id=1725317 darwin error report

@grahamc
Copy link
Member

grahamc commented Jun 30, 2019

@GrahamcOfBorg build libvirt

@alyssais
Copy link
Member

This is why I said

I'll open an upstream bug on that once I've also updated/patched master.

Apologies, I missed that.

@alyssais alyssais merged commit 37b61c9 into NixOS:release-19.03 Jun 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fpletz fpletz Awaiting requested review from fpletz

Assignees
No one assigned
Labels
10.rebuild-darwin: 11-100 10.rebuild-linux: 11-100
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@risicle @alyssais @grahamc