Bug 2212936

Summary:	Rebase to 0.21.1 or later
Product:	Red Hat Enterprise Linux 9	Reporter:	Debarshi Ray <debarshir>
Component:	LibRaw	Assignee:	Debarshi Ray <debarshir>
Status:	CLOSED MIGRATED	QA Contact:	Tomas Pelka <tpelka>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.4	CC:	redhat, tpelka, tpopela
Target Milestone:	rc	Keywords:	MigratedToJIRA, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	LibRaw-0.21.1-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-07-12 06:03:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2188284, 2212944

Description Debarshi Ray 2023-06-06 16:16:33 UTC

Currently, RHEL 9 has LibRaw 0.20.2, which no longer receives CVE fixes upstream and we don't have the resources to backport and test them downstream.  It will be wise to rebase to a more recent LibRaw branch (ie., 0.21.x).  It will prepare us for sufficiently important CVEs that need to be fixed in z-streams without a rebase.

Comment 1 Debarshi Ray 2023-06-06 16:23:29 UTC

It will be good to throw in the commit for CVE-2023-1729 (bug 2188284):
https://github.com/LibRaw/LibRaw/commit/477e0719ffc07190c89b4f3d12d51b1292e75828

Comment 5 Arne Reiter 2023-11-30 16:51:19 UTC

*** Bug 2252132 has been marked as a duplicate of this bug. ***