Re: [SONAME BUMP] capnproto 0.10.2

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Dec 1, 2022 at 12:50 PM Fabio Valentini <decathorpe@xxxxxxxxx> wrote:
>
> On Tue, Nov 29, 2022 at 10:17 PM Neal Gompa <ngompa13@xxxxxxxxx> wrote:
> >
> > On Tue, Nov 29, 2022 at 9:25 AM Neal Gompa <ngompa13@xxxxxxxxx> wrote:
> > >
> > > Hey all,
> > >
> > > capnproto 0.10.2 is being upgraded in Rawhide. As part of this, I'll
> > > be rebuilding its reverse dependencies:
> > >
> > > * fastnetmon
> > > * librime
> > > * rr
> > > * sonic-visualiser
> > >
> > > I'm taking care of all of this in a side-tag and will merge them into
> > > Rawhide once everything is done.
> > >
> >
> > This is now done: https://bodhi.fedoraproject.org/updates/FEDORA-2022-7c8341e00e
>
> Done just in time for a CVE to be filed against capnproto < 0.10.3 :D
>
> All currently available versions in Fedora and EPEL 7 (?), 8, and 9
> are vulnerable to CVE-2022-46149, according to the upstream advisory:
> https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
>
> And according to upstream, dependent packages will need to be rebuilt
> too, because the affected capnproto code is inlined into binaries ...
> Looking at what we currently have in Fedora, Rawhide and EPEL 9 will
> need to be updated to v0.10.3, and f37 and f36 will need to be updated
> to v0.9.2, and EPEL 8 will need to be updated to v0.7.1. Not sure
> about EPEL 7, the version there is ancient, and the v0.5 branch is not
> mentioned in the advisory.

Actually, what's sort of crap is that reverse dependencies always have
to be rebuilt because upstream uses the full version in the soname. It
makes upgrading this library a pain.

>
> If you need help with any of the rebuilds, feel free to ping me.
> I'm currently handling the same CVE for the capnp Rust crate (where
> thankfully only one application needs to be rebuilt).
>

Help would very much be appreciated, I'm currently underwater with other work.


-- 
真実はいつも一つ!/ Always, there's only one truth!
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux