2024-01-08 12:48:21 <ikke> https://mastodon.social/@bagder/111719876376557656 alpine 
2024-01-08 12:48:45 <ikke> Alpine curl is built without PSL support 
2024-01-08 14:40:22 <jvoisin> why is this even an option, and not an on-by-default-one :<
2024-01-08 14:42:18 <ikke> Requires libpsl to be present 
2024-01-08 14:48:30 <jvoisin> thanks <3
2024-01-08 14:57:09 <kpcyrd> "you're silently missing features based on installed libraries" is so silly
2024-01-08 14:58:07 <kpcyrd> I'd rather have the build fail until I either provide the correct libraries, or I opt-out of this feature
2024-01-08 15:03:10 <jvoisin> no no kpcyrd, it's all your fault.
2024-01-08 15:17:48 <kpcyrd> 🥲
2024-01-08 16:11:48 <ikke> The problem is that libpsl is in community in Alpine, it would need to be moved to main
2024-01-08 16:41:42 <ncopa> lets move it
2024-01-08 19:16:45 <ikke> https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/58596
2024-01-08 19:18:28 <fluix> typo in second commit message, s/main$/community/
2024-01-08 19:19:46 <ikke> fluix: thanks, fixed
2024-01-08 19:59:37 <jvoisin> https://gitlab.alpinelinux.org/alpine/aports/-/issues/15655 security-relatedd suggestion
2024-01-08 20:05:40 <minimal> jvoisin: I'd expect some of those programs would have a use in some containers, i.e. LXC containers
2024-01-08 20:06:47 <minimal> indeed why would it be expected that a Docker container should never be able to run traceroute/traceroute6? i.e. someone might wish to use those in a network-diagnostics related Docker container
2024-01-08 20:08:43 <jvoisin> minimal: then they can install busybox-setuid :)
2024-01-08 20:08:57 <jvoisin> I don't advocate for removing it, simply to be able to
2024-01-08 20:09:27 <ikke> jvoisin: apk add -t busybox-suid :P
2024-01-08 20:10:36 <jvoisin> 
ACTION sighs

2024-01-14 13:25:55 <omni> WhyNotHugo asked about CVE-2023-45866, https://github.com/advisories/GHSA-qjcj-xg77-6c32
2024-01-14 13:26:55 <omni> the patch that archlinux uses https://gitlab.archlinux.org/archlinux/packaging/packages/bluez/-/commit/47e9592b1b322c54bdb094238f52fa20513c624b seem to be in by 5.71 https://github.com/bluez/bluez/commit/25a471a83e02e1effb15d5a488b3f0085eaeb675
2024-01-14 13:27:24 <omni> in stable releases we package 5.70 and earlier so it could be an idea to patch
2024-01-14 13:28:25 <omni> but archlinux and ubuntu users have reported issues since it was patched for those distros https://github.com/bluez/bluez/issues/673#issuecomment-1854599254
2024-01-14 13:40:09 <omni> patched as in the default setting was changed
2024-01-16 13:03:41 <omni> new and old https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests?label_name%5B%5D=tag%3Asecurity
2024-01-17 22:18:50 <omni> XSA-448 will be public on tuesday https://xenbits.xen.org/xsa/
2024-01-18 06:38:09 <ikke> Fun, bunch of CVE reports where the reported did not verify whether they are actually relevant :/
2024-01-18 06:38:17 <ikke> reporter*
2024-01-18 12:06:27 <ikke> Can someone review this? I've backported it from the commit that was reported in the NVD CVE report: https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/59159
2024-01-18 13:05:29 <ncopa> the patch applied cleanly?
2024-01-18 13:06:50 <ikke> Yes, only the filenames and offsets had to be changed
2024-01-18 13:07:14 <ikke> And I skipped testdata hunk, since that's not present
2024-01-18 13:07:44 <ikke> But the pre-image matched exactly
2024-01-18 13:08:08 <ncopa> then I'd assume its good
2024-01-18 13:09:12 <ikke> I'll try to backport it further as well
2024-01-18 13:09:28 <ncopa> 👍
2024-01-19 03:36:26 <omni> is #15688 about that issue where "all" the aports would need to be rebuilt for aarch64?
2024-01-19 03:36:51 <omni> so that 3.19 is the only stable release where that is the case
2024-01-19 07:02:44 <ncopa> I dont think we bother rebuild all.
2024-01-19 09:43:52 <omni> but gcc isn't patched either, right?
2024-01-19 09:44:48 <omni> for releases prior to 3.19-stable
2024-01-19 11:29:59 <ikke> CVE-2024-0684 heap overflow in gnu coreutils split
2024-01-19 11:30:18 <ikke> https://github.com/coreutils/coreutils/commit/c4c5ed8f4e9cd55a12966d4f520e3a13101637d9
2024-01-23 12:07:38 <omni> ah, XSA-448 was disclosed yesterday and the issue was in linux
2024-01-23 12:07:42 <omni> https://xenbits.xen.org/xsa/advisory-448.html
2024-01-23 12:08:14 <omni> "The embargo was intended to be 2024-01-23 12:00 UTC, but a downstream had a mixup of days and published early."
2024-01-23 12:09:17 <omni> "All systems using a Linux based network backend with kernel 4.14 and newer are vulnerable.  Earlier versions may also be vulnerable.  Systems using other network backends are not known to be vulnerable."
2024-01-23 12:09:53 <ikke> omni: sounds like work to do
2024-01-23 12:10:20 <omni> https://xenbits.xen.org/xsa/xsa448-linux.patch 
2024-01-23 12:11:31 <omni> yes
2024-01-23 13:07:27 <omni> !59461
2024-01-23 13:07:58 <omni> the patch also aplies cleanly to linux-5.15.y
2024-01-23 13:08:18 <omni> if no-one beats me to it, I may create MRs for stable releases later
2024-01-23 13:09:05 <omni> for 3.19 this could be done at the same time as upgrading linux to 6.6.13
2024-01-23 13:10:03 <omni> at the same time _rel could be reset to 0 for some of the -lts aports as I've done in the MR above
2024-01-25 21:44:44 <omni> openssl & mariadb https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests?label_name%5B%5D=tag%3Asecurity
2024-01-26 00:35:59 <omni> ..and now also others
2024-01-26 00:39:24 <fluix> > Thres a tyop in teh comit mesag ehre adn en
2024-01-26 00:39:25 <fluix> lol
2024-01-26 00:39:52 <minimal> tldr
2024-01-27 00:19:58 <omni> ouch, I just noticed this https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7
2024-01-27 00:20:52 <omni> !59686 !59687 !59688 !59689 !59690
2024-01-27 00:45:47 <omni> I think I'll get them in in a bit
2024-01-27 07:37:27 <ikke> Fun, a whole lot of possible CVEs dumped, but many of them appear to be bogus: https://www.openwall.com/lists/oss-security/2024/01/26/2
2024-01-30 13:46:05 <omni> 0: under secfixes is where you nack, right?
2024-01-30 13:58:26 <ikke> Yes
2024-01-30 13:58:33 <ikke> Curl?
2024-01-30 14:03:05 <omni> no, xen, XSA-450
2024-01-30 14:03:30 <omni> !59920 !59921 !59927
2024-01-30 14:11:20 <omni> !59930 !59932
2024-01-31 22:50:27 <ncopa> omni: 0: means we were never ever affected. (aka "fixed" since version 0)
2024-01-31 22:57:48 <omni> ah, thanks