GNU bug report logs - #26431
[PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: ludo <at> gnu.org (Ludovic Courtès)
Cc: tracker <at> debbugs.gnu.org
Subject: bug#26431: closed ([PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2)
Date: Mon, 10 Apr 2017 21:58:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Mon, 10 Apr 2017 23:57:37 +0200
with message-id <87k26sdiy6.fsf <at> gnu.org>
and subject line Re: bug#26431: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
has caused the debbugs.gnu.org bug report #26431,
regarding [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
26431: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=26431
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Ludovic Courtès <ludo <at> gnu.org>
To: guix-patches <at> gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>
Subject: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
Date: Mon, 10 Apr 2017 15:39:36 +0200

Hello,

These patches fix <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2017-7186>
in pcre and pcre2 using the upstream patches referenced in the CVE database.

Ludo'.

Ludovic Courtès (2):
  gnu: pcre2: Patch CVE-2017-7186.
  gnu: pcre: Patch CVE-2017-7186.

 gnu/local.mk                                   |  2 +
 gnu/packages/patches/pcre-CVE-2017-7186.patch  | 55 +++++++++++++++++++++
 gnu/packages/patches/pcre2-CVE-2017-7186.patch | 67 ++++++++++++++++++++++++++
 gnu/packages/pcre.scm                          | 13 ++++-
 4 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/pcre-CVE-2017-7186.patch
 create mode 100644 gnu/packages/patches/pcre2-CVE-2017-7186.patch

-- 
2.12.2

[Message part 3 (message/rfc822, inline)]

From: ludo <at> gnu.org (Ludovic Courtès)
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 26431-done <at> debbugs.gnu.org
Subject: Re: bug#26431: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
Date: Mon, 10 Apr 2017 23:57:37 +0200

Heya,

Marius Bakke <mbakke <at> fastmail.com> skribis:

> Ludovic Courtès <ludo <at> gnu.org> writes:
>
>> Hello,
>>
>> These patches fix <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2017-7186>
>> in pcre and pcre2 using the upstream patches referenced in the CVE database.
>>
>> Ludo'.
>>
>> Ludovic Courtès (2):
>>   gnu: pcre2: Patch CVE-2017-7186.
>>   gnu: pcre: Patch CVE-2017-7186.
>
> Thank you for these! Please add URLs to the upstream fixes in the patch
> headers:
>
> https://vcs.pcre.org/pcre?view=revision&revision=1688
> https://vcs.pcre.org/pcre2?view=revision&revision=670

Done and pushed, thanks for your quick reply!

FWIW there’s still work to do on pcre:

  $ ./pre-inst-env guix lint -c cve pcre pcre2
  gnu/packages/pcre.scm:76:2: pcre <at> 8.40: probably vulnerable to CVE-2017-7244, CVE-2017-7245, CVE-2017-7246

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.