| Summary: | dbus: patch applied incorrectly due to the bad _default_patch_fuzz setting in the spec file | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Tomas Hoger <thoger> | ||||||
| Component: | dbus | Assignee: | David King <dking> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Desktop QE <desktop-qa-list> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | 6.0 | CC: | security-response-team | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | dbus-1.2.24-7.el6_3 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2015-02-06 14:14:53 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 684853, 840699 | ||||||||
| Attachments: |
|
||||||||
|
Description
Tomas Hoger
2011-03-31 08:03:17 UTC
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative. (In reply to comment #0) > Description of problem: > A patch to address CVE-2010-4352 (bug #663673) as used in the dbus packages in > EL6 is not applied correctly. This is due to one of the hunks from the > upstream git changeset not being applicable to the EL6 code base: Argh =/ > This value is used to determine required size for the validities_seen[] array. But validities_seen is only built in the tests; it's not run as part of the daemon. So it's not worth doing an update for. How did you notice this issue? Looking around in the code I'm not seeing how this could create a runtime problem. (In reply to comment #4) > > This value is used to determine required size for the validities_seen[] array. > > But validities_seen is only built in the tests; it's not run as part of the > daemon. So it's not worth doing an update for. Ok, thank you for looking. > How did you notice this issue? Looking around in the code I'm not seeing how > this could create a runtime problem. It was reported by a user trying to do rebuild with _default_patch_fuzz definition removed, indicating we've not really patched the original issue. (In reply to comment #5) > It was reported by a user trying to do rebuild with _default_patch_fuzz > definition removed, indicating we've not really patched the original issue. Ok, that makes sense. Is there a procedure for committing things that we want in case a future update is made? Could I fix the patch in CVS, referencing the original bug? (In reply to comment #6) > Ok, that makes sense. Is there a procedure for committing things that we want > in case a future update is made? Could I fix the patch in CVS, referencing the > original bug? The patch needs to be committed to CVS HEAD anyway (bug #684853), so we can commit corrected version there. I'm not sure what would be the cleanest way process-wise to correct in 6.0 branch, original bug should still allow you to commit though. Looks like this bug needs pm_ack ? Created attachment 504209 [details]
patch for spec
Created attachment 504210 [details] rebased correct CVE-2010-4352 patch Oh I see, I have to use bug 684583 in the commit. Done. Should this bug be closed now or should we reopen it in case we need to update the Z-stream again? Updated patch file (comment #10) was not committed. Once that happens, please move this to modified. This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative. This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux. This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux. This was fixed in RHEL 6.3. |