Red Hat Bugzilla – Bug 847827
Current version of calibre in Fedora-17 uses embedded copy of python-feedparser rather than the system one
Last modified: 2012-08-22 17:14:18 EDT
+++ This bug was initially created as a clone of Bug #847825 +++
Description of problem:
Current version of calibre package in Fedora-17 (calibre-0.8.50-1.fc17) uses its own bundled copy of the python-feedparser code (BUILD/calibre/src/calibre/web/feeds/feedparser.py), instead of the system one. Though right now it seems to be updated against all of the recent python-feedparser flaws (CVE-2009-5065, CVE-2011-1156, CVE-2011-1157, and CVE-2011-1158), it is not a good practice to use embedded copy instead of the system one (since once a security flaw is found in the embedded package, both packages [the system one, and the embedding one] need to be updated).
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Check content of BUILD/calibre/src/calibre/web/feeds/feedparser.py
and / or check output of 'rpm -q --requires calibre' command
python-feedparser not listed in above rpm command output
python-feedparser listed in rpm check && calibre using system python-feedparser version (python-feedparser-5.1.2-2.fc17 available currently, also containing fixes for above four CVE issues already)
See similar https://bugzilla.redhat.com/show_bug.cgi?id=846757 if necessary
Thanks for the info.
I think I have this unbundled in rawhide/f18 and update for f17 coming.
I'm going to have to look at f16, since it's so many versions behind.
calibre-0.8.63-1.fc17 has been submitted as an update for Fedora 17.
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing calibre-0.8.63-1.fc17'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
calibre-0.8.63-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.