GNU bug report logs - #29526
[PATCH] gnu: bazaar: Fix CVE-2017-14176.

Previous Next

Full log

Message #8 received at 29526 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Leo Famulari <leo <at> famulari.name>, 29526 <at> debbugs.gnu.org
Subject: Re: [bug#29526] [PATCH] gnu: bazaar: Fix CVE-2017-14176.
Date: Sun, 03 Dec 2017 15:21:39 +0100

[Message part 1 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> * gnu/packages/patches/bazaar-CVE-2017-14176.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/version-control.scm (bazaar)[source]: Use it.

[...]

> diff --git a/gnu/packages/patches/bazaar-CVE-2017-14176.patch b/gnu/packages/patches/bazaar-CVE-2017-14176.patch
> new file mode 100644
> index 000000000..0e9083b97
> --- /dev/null
> +++ b/gnu/packages/patches/bazaar-CVE-2017-14176.patch
> @@ -0,0 +1,166 @@
> +Fix CVE-2017-14176:
> +
> +https://bugs.launchpad.net/bzr/+bug/1710979
> +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14176
> +
> +Patch copied from Debian's Bazaar package version bzr_2.7.0+bzr6619-7+deb9u1:
> +
> +https://alioth.debian.org/scm/loggerhead/pkg-bazaar/bzr/2.7/revision/4204

I was looking for a fix for this a couple of days ago as well, but could
not find anything in the upstream repository:

https://code.launchpad.net/bzr

LGTM, and thanks!

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.