docker.io: CVE-2017-14992

Debian Bug report logs - #908055
docker.io: CVE-2017-14992

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@orangeseeds.org>

To: submit@bugs.debian.org

Subject: docker.io: CVE-2017-14992

Date: Wed, 5 Sep 2018 10:34:50 -0400

[Message part 1 (text/plain, inline)]

Package: docker.io
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security
Control: clone -1 -2
Control: reassign -2 golang-github-vbatts-tar-split

Hi,

The following vulnerability was published for docker.io.

CVE-2017-14992[0]:
| Lack of content verification in Docker-CE (Also known as Moby)
| versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0,
| 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to
| cause a Denial of Service via a crafted image layer payload, aka gzip
| bombing.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14992
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14992

Please adjust the affected versions in the BTS as needed.

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zsj950618@gmail.com>

To: 908055@bugs.debian.org

Subject: Re: Bug#908055: docker.io: CVE-2017-14992

Date: Wed, 5 Sep 2018 23:22:02 +0800

Dear docker.io maintainer,

I'm not sure why the Built-Using field in docker.io doesn't contain
golang-github-vbatts-tar-split. Maybe dh-golang can't deal with the
docker.io repo. Not sure it's whose bug...

Since the version in unstable/testing is not uploaded with
source-only, so the buildd doesn't have buildinfo for amd64. But I
guess it was built with golang-github-vbatts-tar-split 0.10.2-1(which
was uploaded at 2017-11-30). Thus the docker.io version in
testing/unstable is not affected by this security issue.

-- 
Regards,
Shengjing Zhu

Message #21 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Arnaud Rebillout <arnaud.rebillout@collabora.com>

To: Shengjing Zhu <zsj950618@gmail.com>, 908055@bugs.debian.org

Subject: Re: Bug#908055: docker.io: CVE-2017-14992

Date: Thu, 6 Sep 2018 08:40:37 +0700

On 09/05/2018 10:22 PM, Shengjing Zhu wrote:
> Dear docker.io maintainer,
>
> I'm not sure why the Built-Using field in docker.io doesn't contain
> golang-github-vbatts-tar-split. Maybe dh-golang can't deal with the
> docker.io repo. Not sure it's whose bug...

Built-Using is supposed to reflect the build dependencies, isn't it?

A quick look at the docker.io package in experiemental: there's around
130 build dependencies in debian/control, and only 33 packages in the
Built-Using field of the binary package... So there seem to be a
problem. A quick look at consul, another "big" package, also shows
surprising numbers, around 50 build dependencies, and only ... 33
packages again in Built-Using!

Message #26 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zsj950618@gmail.com>

To: Arnaud Rebillout <arnaud.rebillout@collabora.com>

Cc: 908055@bugs.debian.org

Subject: Re: Bug#908055: docker.io: CVE-2017-14992

Date: Thu, 6 Sep 2018 10:32:37 +0800

On Thu, Sep 6, 2018 at 9:40 AM Arnaud Rebillout
<arnaud.rebillout@collabora.com> wrote:
>
>
> On 09/05/2018 10:22 PM, Shengjing Zhu wrote:
> > Dear docker.io maintainer,
> >
> > I'm not sure why the Built-Using field in docker.io doesn't contain
> > golang-github-vbatts-tar-split. Maybe dh-golang can't deal with the
> > docker.io repo. Not sure it's whose bug...
>
> Built-Using is supposed to reflect the build dependencies, isn't it?
>

Yes, not only packages listed in Build-Depends, but also the indirect depends.

Implementation details in dh-golang is: it runs `go list {{ .Dep }}` ,
to get all the dependencies.
https://sources.debian.org/src/dh-golang/1.35/script/dh_golang/#L73

I guess the manual manipulation of DH_GOPKG in d/rules comfuses dh-golang.


-- 
Regards,
Shengjing Zhu

Message #31 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Dmitry Smirnov <onlyjob@debian.org>

Cc: 908055@bugs.debian.org

Subject: Re: Processed: fixed 908055 in 17.12.1+dfsg-1

Date: Mon, 10 Sep 2018 08:18:56 +0200

Hi Dmitry,

On Mon, Sep 10, 2018 at 09:23:59AM +1000, Dmitry Smirnov wrote:
> On Thursday, 6 September 2018 2:19:24 PM AEST Salvatore Bonaccorso wrote:
> > > > fixed 908055 17.12.1+dfsg-1
> > 
> > Is this the first version which was using the fixed
> > golang-github-vbatts-tar-split?
> 
> Yes it is. I've confirmed that by examining the build log.

Perfect, thanks for confirming!

Regards,
Salvatore

Message #36 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Arnaud Rebillout <arnaud.rebillout@collabora.com>

To: 908055@bugs.debian.org

Subject: Re: Processed: fixed 908055 in 17.12.1+dfsg-1

Date: Fri, 1 Feb 2019 08:13:01 +0700

On Mon, 10 Sep 2018 08:18:56 +0200 Salvatore Bonaccorso
<carnil@debian.org> wrote:
> Hi Dmitry,
>
> On Mon, Sep 10, 2018 at 09:23:59AM +1000, Dmitry Smirnov wrote:
> > On Thursday, 6 September 2018 2:19:24 PM AEST Salvatore Bonaccorso
wrote:
> > > > > fixed 908055 17.12.1+dfsg-1
> > >
> > > Is this the first version which was using the fixed
> > > golang-github-vbatts-tar-split?
> >
> > Yes it is. I've confirmed that by examining the build log.
>
> Perfect, thanks for confirming!
>
> Regards,
> Salvatore
>

If I understand, this bug is fixed? Should we close it?

Message #41 received at 908055@bugs.debian.org (full text, mbox, reply):

From: Dmitry Smirnov <onlyjob@debian.org>

To: Arnaud Rebillout <arnaud.rebillout@collabora.com>, 908055@bugs.debian.org

Subject: Re: Bug#908055: Processed: fixed 908055 in 17.12.1+dfsg-1

Date: Fri, 01 Feb 2019 13:01:10 +1100

[Message part 1 (text/plain, inline)]

On Friday, 1 February 2019 12:13:01 PM AEDT Arnaud Rebillout wrote:
> If I understand, this bug is fixed? Should we close it?

Yes, I think it should be closed.
There is no actionable tasks are left for maintainers to do...

-- 
All the best,
 Dmitry Smirnov.

---

No person, no idea, and no religion deserves to be illegal to insult,
not even the Church of Emacs.
        -- Richard Stallman

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 908055-done@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zhsj@debian.org>

To: 908055-done@bugs.debian.org

Subject: Re: Bug#908055: docker.io: CVE-2017-14992

Date: Mon, 10 Jun 2019 19:40:10 +0800

Not sure why this bug is fixed, but not closed. Try closing it...

-- 
Shengjing Zhu

Send a report that this bug log contains spam.