Verified Commit c7c4ad8d authored by TheEvilSkeleton's avatar TheEvilSkeleton
Browse files

Arch Linux now patches libssh2

Credit to Outvi V - https://blog.outv.im/
Credit to u/sa7dse - https://www.reddit.com/r/linux/comments/m8mjtv/response_to_flatkillorg/grivf2v/?context=3
parent 8e0bd5e6
Pipeline #400229 passed with stage
in 2 minutes and 58 seconds
......@@ -56,8 +56,7 @@ Fortunately, this problem has been solved in recent updates. If this problem per
>
> A perfect example is [CVE-2019-17498](https://www.cvedetails.com/cve/CVE-2019-17498) with public exploit [available](https://github.com/github/securitylab/tree/main/SecurityExploits/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498) for some 8 months. The first app on Flathub I find to use libssh2 library is Gitg and, indeed, it does ship with unpatched libssh2.
~~Most, if not all, distributions that ship with libssh2 do not patch libssh2 as well. An example of such distribution is [Arch Linux](https://github.com/archlinux/svntogit-packages/blob/packages/libssh2/trunk/PKGBUILD). Further, if this was a very big deal, the libssh2 maintainers would have released a new version with the patch immediately. Despite being a [very active project](https://github.com/libssh2/libssh2/commits/master), they still haven't released a new update with the fix as of writing this response.~~ Correction: I want to apologize for spreading misinformation. Some of the most used Linux distributions, such as [openSUSE](https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html), [Debian](https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html), [Gentoo](https://web.archive.org/web/20210316021630/https://gitweb.gentoo.org/repo/gentoo.git/tree/net-libs/libssh2/libssh2-1.9.0_p20200614.ebuild#n8), recent [Ubuntu](https://ubuntu.com/security/CVE-2019-17498) releases and [Fedora](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/) come with patched libssh2 builds. Only Arch Linux does not.
~~Most, if not all, distributions that ship with libssh2 do not patch libssh2 as well. An example of such distribution is [Arch Linux](https://github.com/archlinux/svntogit-packages/blob/packages/libssh2/trunk/PKGBUILD). Further, if this was a very big deal, the libssh2 maintainers would have released a new version with the patch immediately. Despite being a [very active project](https://github.com/libssh2/libssh2/commits/master), they still haven't released a new update with the fix as of writing this response.~~ Correction: I want to apologize for spreading misinformation. Some of the most used Linux distributions, such as [openSUSE](https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html), [Debian](https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html), [Gentoo](https://web.archive.org/web/20210316021630/https://gitweb.gentoo.org/repo/gentoo.git/tree/net-libs/libssh2/libssh2-1.9.0_p20200614.ebuild#n8), recent [Ubuntu](https://ubuntu.com/security/CVE-2019-17498) releases and [Fedora](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/), and recently [Arch Linux](https://github.com/archlinux/svntogit-packages/commit/6bc1c991d8f1ae1a40b98a9d7dc21fa3f4a37419) come with patched libssh2 builds.
A few months ago, I [submitted](https://gitlab.gnome.org/GNOME/gitg/-/issues/313) an issue in the Gitg issue tracker. The maintainer replied to me: ***"Reviewing ssh feature, it is not even touched on gitg or libgit2-glib, just a dependency on libgit2, \[...\]"***.<sup>[(Source)](https://gitlab.gnome.org/GNOME/gitg/-/issues/313#note_972928)</sup>
Although it comes with an unpatched libssh2, Gitg does not use the part that contains the vulnerability.
......@@ -87,3 +86,4 @@ If you don't like Flatpak for personal reasons, I respect your opinion, but basi
- Edit 4: Mention Portals and improve sentences; remove misinformation (credit to [Shipp](https://shipp.dev/), [DeepL Translator](https://www.deepl.com/translator) and vidal72) — (2021-03-16)
- Edit 5: Highlight current Linux desktop problems (credit to [Robert McQueen](https://ramcq.net/2018/10/15/flatpak-sandbox-security/)) — (2021-03-18)
- Edit 6: Improve wording to avoid misleading portals (credit to [Phaedrus Leeds](https://github.com/mwleeds)) — (2021-03-18)
- Edit 7: Arch Linux now patches libssh2 (credit to [Outvi V](https://blog.outv.im/) and [u/sa7dse](https://www.reddit.com/r/linux/comments/m8mjtv/response_to_flatkillorg/grivf2v/?context=3)) — (2021-03-22)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment