GNU bug report logs - #74060
[PATCH] gnu: Remove allegro-5.0. [security fixes]

Previous Next

Full log

View this message in rfc822 format

From: Nicolas Graves <ngraves <at> ngraves.fr>
To: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Cc: 74060 <at> debbugs.gnu.org
Subject: [bug#74060] [PATCH] gnu: Remove allegro-5.0. [security fixes]
Date: Mon, 11 Nov 2024 15:17:47 +0100

On 2024-11-11 21:37, Maxim Cournoyer wrote:

> Hi!
>
> Nicolas Graves <ngraves <at> ngraves.fr> writes:
>
>> This package has no dependencies in Guix, is unsupported (see
>> https://liballeg.org/old.html) and is vulnerable to CVE-2021-36489.
>>
>> * gnu/packages/game-development.scm (allegro-5.0): Delete variable.
>> * gnu/local.mk: Deregister patch.
>> * gnu/packages/patches/allegro-mesa-18.2.5-and-later.patch: Delete file.
>
> We also have an allegro-4.0 variable; is this one not vulnerable?
> https://nvd.nist.gov/vuln/detail/CVE-2021-36489 suggest it is (up to
> 5.2.6).

If it is removable easily, we should remove it yes.  I might have
forgotten this one.

They are indeed unsupported versions, I reported that upstream in
https://github.com/liballeg/allegro5/issues/1587
which confirmed that these versions won't receive security patches.

-- 
Best regards,
Nicolas Graves

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.