GNU bug report logs - #46183
[PATCH 0/1] Update gcrypt [URGENT SECURITY ISSUE]

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 46183 in the body.
You can then email your comments to 46183 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Ryan Prior <rprior <at> protonmail.com>
To: guix-patches <at> gnu.org
Subject: [PATCH 0/1] Update gcrypt [URGENT SECURITY ISSUE]
Date: Sat, 30 Jan 2021 04:20:50 +0000

Hi Guix! Please review ASAP. This update fixes an exploitable heap overflow.

 ## Info

https://dev.gnupg.org/T5275

https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html

Ryan Prior (1):
  gnu: libgcrypt: Update to 1.9.1.

 gnu/packages/gnupg.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

-- 
2.30.0

Message #8 received at 46183 <at> debbugs.gnu.org (full text, mbox):

From: Ryan Prior <rprior <at> protonmail.com>
To: 46183 <at> debbugs.gnu.org
Subject: [PATCH 1/1] gnu: libgcrypt: Update to 1.9.1.
Date: Sat, 30 Jan 2021 04:24:31 +0000

* gnu/packages/gnupg.scm (libcrypt): Update to 1.9.1.
---
 gnu/packages/gnupg.scm | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index a2da166bb4..f226d092dc 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -131,14 +131,13 @@ Daemon and possibly more in the future.")
 (define-public libgcrypt
   (package
     (name "libgcrypt")
-    (version "1.8.5")
+    (version "1.9.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnupg/libgcrypt/libgcrypt-"
                                  version ".tar.bz2"))
              (sha256
-              (base32
-                "1hvsazms1bfd769q0ngl0r9g5i4m9mpz9jmvvrdzyzk3rfa2ljiv"))))
+              (base32 "1nb50bgzp83q6r5cz4v40y1mcbhpqwqyxlay87xp1lrbkf5pm9n5"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libgpg-error-host" ,libgpg-error)))
-- 
2.30.0

Message #11 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Tobias Geerinckx-Rice <me <at> tobias.gr>
To: Ryan Prior <rprior <at> protonmail.com>
Cc: 46183 <at> debbugs.gnu.org, guix-patches <at> gnu.org
Subject: Re: [bug#46183] [PATCH 1/1] gnu: libgcrypt: Update to 1.9.1.
Date: Sat, 30 Jan 2021 09:08:31 +0100

[Message part 1 (text/plain, inline)]

Ryan,

guix-patches--- via 写道：
> * gnu/packages/gnupg.scm (libcrypt): Update to 1.9.1.

Thanks.

> -    (version "1.8.5")
> +    (version "1.9.1")

libgcrypt has 12119(!) dependent packages.  Can we use a graft 
here?  This nongrafted version can then go to core-updates.

Grafting means we keep these packages built against 1.8.5 and 
force-feed them 1.9.1 instead, which might not work reliably 
across minor versions but needs to be tried before rebuilding the 
world.

Kind regards,

T G-R

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 46183 <at> debbugs.gnu.org (full text, mbox):

From: Guillaume Le Vaillant <glv <at> posteo.net>
To: Tobias Geerinckx-Rice <me <at> tobias.gr>
Cc: Ryan Prior <rprior <at> protonmail.com>, 46183 <at> debbugs.gnu.org
Subject: Re: [bug#46183] [PATCH 1/1] gnu: libgcrypt: Update to 1.9.1.
Date: Sat, 30 Jan 2021 09:39:16 +0100

[Message part 1 (text/plain, inline)]

guix-patches--- via <guix-patches <at> gnu.org> skribis:

> Ryan,
>
> guix-patches--- via 写道：
>> * gnu/packages/gnupg.scm (libcrypt): Update to 1.9.1.
>
> Thanks.
>
>> -    (version "1.8.5")
>> +    (version "1.9.1")
>
> libgcrypt has 12119(!) dependent packages.  Can we use a graft here?  This
> nongrafted version can then go to core-updates.
>
> Grafting means we keep these packages built against 1.8.5 and force-feed them
> 1.9.1 instead, which might not work reliably across minor versions but needs to
> be tried before rebuilding the world.
>
> Kind regards,
>
> T G-R

According to the news at https://gnupg.org:

--8<---------------cut here---------------start------------->8---
Libgcrypt 1.9.1 released (2021-01-29)   important

Unfortunately we introduced a severe bug in Libgcrypt 1.9.0 released 10 days ago.
If you already started to use version 1.9.0 please update immediately to 1.9.1.
--8<---------------cut here---------------end--------------->8---

Currently the master and staging branch are using libgcrypt 1.8.5 and
core-updates is using 1.8.7. These versions don't have the critical bug
as it was introduced in version 1.9.0. So I think updating libgcrypt on
master is not an emergency, we just have to remember to never use
version 1.9.0.

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 46183 <at> debbugs.gnu.org (full text, mbox):

From: lordyuuma <at> gmail.com
To: Ryan Prior <rprior <at> protonmail.com>, 46183 <at> debbugs.gnu.org
Subject: Re: [PATCH 0/1] Update gcrypt [URGENT SECURITY ISSUE]
Date: Sat, 30 Jan 2021 08:56:08 +0100

Hi Ryan,

Am Samstag, den 30.01.2021, 04:20 +0000 schrieb Ryan Prior:
> Hi Guix! Please review ASAP. This update fixes an exploitable heap
> overflow.
> 
> https://dev.gnupg.org/T5275
> 
> https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html

I have some good news and some bad news.  The good news is, that
according to your sources this affects only version 1.9.0, so master is
currently safe.  The bad news is, that libgcrypt has more than 10000
dependants, so an update for it should go to core-updates.

Regards,
Leo

Message #25 received at 46183-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Guillaume Le Vaillant <glv <at> posteo.net>
Cc: Tobias Geerinckx-Rice <me <at> tobias.gr>, 46183-done <at> debbugs.gnu.org,
 Ryan Prior <rprior <at> protonmail.com>
Subject: Re: bug#46183: [PATCH 0/1] Update gcrypt [URGENT SECURITY ISSUE]
Date: Mon, 01 Feb 2021 12:50:49 +0100

Hi,

Guillaume Le Vaillant <glv <at> posteo.net> skribis:

> According to the news at https://gnupg.org:
>
> Libgcrypt 1.9.1 released (2021-01-29)   important
>
> Unfortunately we introduced a severe bug in Libgcrypt 1.9.0 released 10 days ago.
> If you already started to use version 1.9.0 please update immediately to 1.9.1.
>
> Currently the master and staging branch are using libgcrypt 1.8.5 and
> core-updates is using 1.8.7. These versions don't have the critical bug
> as it was introduced in version 1.9.0. So I think updating libgcrypt on
> master is not an emergency, we just have to remember to never use
> version 1.9.0.

Indeed.  So closing this bug.  That said, we can update libgcrypt in
‘core-updates’.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.