Subject: bug#36424: closed (Re: [bug#36424] expat-2.2.7 for CVE-2018-20843)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 11 Jul 2019 23:01:02 +0000

Your bug report

#36424: expat-2.2.7 for CVE-2018-20843

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
36424: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=36424
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#36424] expat-2.2.7 for CVE-2018-20843
From: Marius Bakke <[email-masked]>
To: Jack Hill <[email-masked]>
Cc: [email-masked]
Date: Fri, 12 Jul 2019 01:00:32 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Jack Hill <[email-masked]> writes:

> Please find updated patch files attached, that I think take into account 
> Marius's suggestions (thanks Marius!)

Thank you!  I made a tiny tweak to use char=? instead of equal=? for the
character comparison.

Pushed as 5a836ce38c9c29e9c2bd306007347486b90c5064.

Subject: expat-2.2.7 for CVE-2018-20843
From: Jack Hill <[email-masked]>
To: [email-masked]
Date: Fri, 28 Jun 2019 15:56:42 -0400 (EDT)
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Guix,

Sebastian Pipping recently wrote to guix-devel@ about expat-2.2.7 which 
fixes CVE-2018-20843 [0]. I've prepared the forthcoming patch to add a 
replacement for expat with expat-2.2.7. I also changed the origin to use 
the GitHub hosted tarball as upstream is moving in that direction.

[0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20843

Best,
Jack