Subject: Re: bug#26431: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
From: [email-masked] (Ludovic Courtès)
To: Marius Bakke <[email-masked]>
Cc: [email-masked]
Date: Mon, 10 Apr 2017 23:57:37 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Heya,

Marius Bakke <[email-masked]> skribis:

> Ludovic Courtès <[email-masked]> writes:
>
>> Hello,
>>
>> These patches fix <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2017-7186>
>> in pcre and pcre2 using the upstream patches referenced in the CVE database.
>>
>> Ludo'.
>>
>> Ludovic Courtès (2):
>>   gnu: pcre2: Patch CVE-2017-7186.
>>   gnu: pcre: Patch CVE-2017-7186.
>
> Thank you for these! Please add URLs to the upstream fixes in the patch
> headers:
>
> https://vcs.pcre.org/pcre?view=revision&revision=1688
> https://vcs.pcre.org/pcre2?view=revision&revision=670

Done and pushed, thanks for your quick reply!

FWIW there’s still work to do on pcre:

  $ ./pre-inst-env guix lint -c cve pcre pcre2
  gnu/packages/pcre.scm:76:2: [email-masked]: probably vulnerable to CVE-2017-7244, CVE-2017-7245, CVE-2017-7246

Ludo’.