GNU bug report logs - #28447
[PATCH] gnu: bluez: Fix CVE-2017-1000250.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 28447 in the body.
You can then email your comments to 28447 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: guix-patches <at> gnu.org
Cc: Marius Bakke <mbakke <at> fastmail.com>
Subject: [PATCH] gnu: bluez: Fix CVE-2017-1000250.
Date: Wed, 13 Sep 2017 17:44:25 +0200

* gnu/packages/linux.scm (%bluez-CVE-2017-1000250.patch): New variable.
(bluez)[replacement]: New field.
(bluez/fixed): New variable.
---
 gnu/packages/linux.scm | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index bfa736c1c..9dc68a2b3 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -3009,10 +3009,24 @@ applications.")
 Bluetooth audio output devices like headphones or loudspeakers.")
     (license license:gpl2+)))
 
+;; Fix remote information disclosure in bluetoothd.
+;; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000250
+;; https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000250.html
+(define %bluez-CVE-2017-1000250.patch
+  (origin
+    (method url-fetch)
+    (uri "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=\
+9e009647b14e810e06626dde7f1bb9ea3c375d09")
+    (file-name "bluez-CVE-2017-1000250.patch")
+    (sha256
+     (base32
+      "0p6gblj775sv0xx4pvdll39j6spg8ihhshid5z6lgrjh0rmxi3sk"))))
+
 (define-public bluez
   (package
     (name "bluez")
     (version "5.45")
+    (replacement bluez/fixed)
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3074,6 +3088,13 @@ Bluetooth audio output devices like headphones or loudspeakers.")
 is flexible, efficient and uses a modular implementation.")
     (license license:gpl2+)))
 
+(define bluez/fixed
+  (package
+    (inherit bluez)
+    (source (origin
+              (inherit (package-source bluez))
+              (patches (list %bluez-CVE-2017-1000250.patch))))))
+
 (define-public fuse-exfat
   (package
     (name "fuse-exfat")
-- 
2.14.1

Message #10 received at 28447-done <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: Mark H Weaver <mhw <at> netris.org>, 28447-done <at> debbugs.gnu.org
Subject: Re: [bug#28447] [PATCH] gnu: bluez: Fix CVE-2017-1000250.
Date: Thu, 14 Sep 2017 10:22:00 +0200

Hi Marius,

Marius Bakke <mbakke <at> fastmail.com> skribis:

> * gnu/packages/linux.scm (%bluez-CVE-2017-1000250.patch): New variable.
> (bluez)[replacement]: New field.
> (bluez/fixed): New variable.

Mark beat you at it:

  https://git.savannah.gnu.org/cgit/guix.git/commit/?id=27236a43486b8fbb9d55d533e558165bab07d020

The only difference I can see is that Mark included the patch in the repo.

Maybe we should coordinate for security fixes via IRC or something.  :-)

Thanks to both of you!

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.