Bug 847827

Summary:	Current version of calibre in Fedora-17 uses embedded copy of python-feedparser rather than the system one
Product:	[Fedora] Fedora	Reporter:	Jan Lieskovsky <jlieskov>
Component:	calibre	Assignee:	Kevin Fenzi <kevin>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	17	CC:	chkr, kevin, mbacovsk, nushio, sysoutfran
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684229
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	847825	Environment:
Last Closed:	2012-08-22 21:14:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	847825
Bug Blocks:

Description Jan Lieskovsky 2012-08-13 16:44:26 UTC

+++ This bug was initially created as a clone of Bug #847825 +++

Description of problem:
Current version of calibre package in Fedora-17 (calibre-0.8.50-1.fc17) uses its own bundled copy of the python-feedparser code (BUILD/calibre/src/calibre/web/feeds/feedparser.py), instead of the system one. Though right now it seems to be updated against all of the recent python-feedparser flaws (CVE-2009-5065, CVE-2011-1156, CVE-2011-1157, and CVE-2011-1158), it is not a good practice to use embedded copy instead of the system one (since once a security flaw is found in the embedded package, both packages [the system one, and the embedding one] need to be updated).

Version-Release number of selected component (if applicable):
calibre-0.8.50-1.fc17

How reproducible:
Always

Steps to Reproduce:
1. Check content of BUILD/calibre/src/calibre/web/feeds/feedparser.py 
   and / or check output of 'rpm -q --requires calibre' command
  
Actual results:
python-feedparser not listed in above rpm command output

Expected results:
python-feedparser listed in rpm check && calibre using system python-feedparser version (python-feedparser-5.1.2-2.fc17 available currently, also containing fixes for above four CVE issues already)

Additional info:
See similar https://bugzilla.redhat.com/show_bug.cgi?id=846757 if necessary

Comment 1 Kevin Fenzi 2012-08-14 03:45:36 UTC

Thanks for the info. 

I think I have this unbundled in rawhide/f18 and update for f17 coming. 

I'm going to have to look at f16, since it's so many versions behind.

Comment 2 Fedora Update System 2012-08-14 04:08:51 UTC

calibre-0.8.63-1.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/calibre-0.8.63-1.fc17

Comment 3 Fedora Update System 2012-08-14 09:22:28 UTC

Package calibre-0.8.63-1.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing calibre-0.8.63-1.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-11860/calibre-0.8.63-1.fc17
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2012-08-22 21:14:18 UTC

calibre-0.8.63-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.