pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian?

Debian Bug report logs - #1023030
pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian?

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefano Rivera <stefanor@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian?

Date: Sat, 29 Oct 2022 13:58:48 +0200

Source: pysha3
Version: 1.0.2-4.2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
Forwarded: https://github.com/tiran/pysha3/issues/29

pysha3 is affected by CVE-2022-37454, a security issue in Keccak
See: https://github.com/python/cpython/issues/98517
https://mouha.be/sha-3-buffer-overflow/

This is a backport module to bring a feature from Python 3.6 back to
older versions.

It seems very dead upstream, should we just remove it from the archive?

There is currently one reverse-dependency, python-opentimestamps, and I
think we can trivially migrate that to use hashlib.

SR

Message #10 received at 1023030@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Stefano Rivera <stefanor@debian.org>, 1023030@bugs.debian.org

Cc: Debian Security Team <team@security.debian.org>

Subject: Re: Bug#1023030: pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian?

Date: Sat, 29 Oct 2022 14:34:35 +0200

Hi Stefano,

On Sat, Oct 29, 2022 at 01:58:48PM +0200, Stefano Rivera wrote:
> Source: pysha3
> Version: 1.0.2-4.2
> Severity: grave
> Tags: security upstream
> Justification: user security hole
> X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
> Forwarded: https://github.com/tiran/pysha3/issues/29
> 
> pysha3 is affected by CVE-2022-37454, a security issue in Keccak
> See: https://github.com/python/cpython/issues/98517
> https://mouha.be/sha-3-buffer-overflow/
> 
> This is a backport module to bring a feature from Python 3.6 back to
> older versions.
> 
> It seems very dead upstream, should we just remove it from the archive?
> 
> There is currently one reverse-dependency, python-opentimestamps, and I
> think we can trivially migrate that to use hashlib.

Probably a good idea, if we can have that happen in time for bookworm.
Will you work on the reverse dependency to make it possible and then
request the removal for src:pysha3?

Regards,
Salvatore

Message #19 received at 1023030@bugs.debian.org (full text, mbox, reply):

From: stefanor@debian.org

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 1023030@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: Bug#1023030: pysha3: Affected by CVE-2022-37454, unmaintained, remove from Debian?

Date: Sat, 29 Oct 2022 12:59:24 +0000

Hi Salvatore (2022.10.29_12:34:35_+0000)
> Probably a good idea, if we can have that happen in time for bookworm.
> Will you work on the reverse dependency to make it possible and then
> request the removal for src:pysha3?

Reverse dependency fixed, I'll file for RM now.

SR

-- 
Stefano Rivera
  http://tumbleweed.org.za/
  +1 415 683 3272

Send a report that this bug log contains spam.