'Re: [Kolab-devel] Erlang security update breaks guam on Debian 10'

[prev in list] [next in list] [prev in thread] [next in thread] 

List: kolab-devel
Subject: Re: [Kolab-devel] Erlang security update breaks guam on Debian 10
From: Lennart Ackermans <lennart () ackermans ! ch>
Date: 2023-07-17 22:13:15
Message-ID: 0102018965ea34ce-f28e464f-f9ca-4010-ba0e-48d9752cc74b-000000 () eu-west-1 ! amazonses ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Debian security packages are usually not in mirrors, so you should also add the official security repo:
http://security.debian.org/debian-security/dists/buster/updates/main/

Lennart

> On 17 Jul 2023, at 23:15, Christoph Erhardt <christoph.erhardt@sicherha.de> wrote:
> 
> Hi Christian,
> 
> unfortunately I'm not familiar with the admin side of OBS. The most plausible 
> thing I have found would be this settings page:
> 
>  https://obs.kolabsys.com/repositories/Debian:10.0
> 
> The mirror URLs configured there lead to a 404, though. It seems there's a 
> path component (`/dists/`) missing in the middle.
> 
>  Broken: https://mirror.switch.ch/ftp/mirror/debian/buster
> Working: https://mirror.switch.ch/ftp/mirror/debian/dists/buster
> 
> Maybe this will suffice to trigger a download-on-demand [1] on the next 
> package build.
> 
> Best,
> Christoph
> 
> [1] https://openbuildservice.org/help/manuals/obs-user-guide/
> cha.obs.concepts.html#concept_dod
> 
>> On Monday, 17 July 2023 07:12:51 CEST Christian Mollekopf wrote:
>>> On Saturday, 15 July 2023 00:04:21 CEST you wrote:
>>> Hi all,
>>> 
>>> if my understanding is correct, CVE-2022-37026 allows an authentication
>>> bypass by clients when using certificate-based authentication, while
>>> 'normal' user/ password-based authentication is not affected.
>>> 
>>> If that is indeed the case, then I believe our quick fix doesn't entail an
>>> immediate risk to Guam users.
>>> 
>>> Nevertheless, I do feel somewhat strongly about doing things the right
>>> way. In our case this would mean:
>>> 1. Make OBS pull the latest Debian 10 packages, including erlang-base.
>>> 2. Revert the patch that enables ERTS bundling for Guam.
>>> 3. Rebuild Guam.
>> 
>> I'd rather have it bundled than wake up to our packages no longer starting
>> because the upstream erts package changed, so for unbundling we need to
>> figure which erts version to pin first IMO.
>>> I'm happy to take care of steps 2 and 3, but step 1 needs to be done by an
>>> OBS admin. Christian? Jeroen?
>> 
>> Do you happen to know how to trigger such an update?
>> I have access, but to me it seems the OBS mostly expects to build agains a
>> static repository.
>> 
>> Cheers,
>> Christian
>> 
>>> Best,
>>> Christoph
>>> 
>>> _______________________________________________
>>> users mailing list
>>> users@lists.kolab.org
>>> https://lists.kolab.org/mailman/listinfo/users
>> 
>> _______________________________________________
>> devel mailing list
>> devel@lists.kolab.org
>> https://lists.kolab.org/mailman/listinfo/devel
> 
> _______________________________________________
> devel mailing list
> devel@lists.kolab.org
> https://lists.kolab.org/mailman/listinfo/devel

[Attachment #5 (text/html)]

<html><head><meta http-equiv="content-type" content="text/html; \
charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr">Debian \
security packages are usually not in mirrors, so you should also add the official \
security repo:</div><div dir="ltr"><a \
href="http://security.debian.org/debian-security/dists/buster/updates/main/">http://security.debian.org/debian-security/dists/buster/updates/main/</a></div><div \
dir="ltr"> </div><div dir="ltr">Lennart</div><div dir="ltr"> </div><div \
dir="ltr"> <div dir="ltr"></div><blockquote type="cite">On 17 Jul 2023, at 23:15, \
Christoph Erhardt &lt;christoph.erhardt@sicherha.de&gt; \
wrote: </blockquote></div><blockquote type="cite"><div dir="ltr">Hi \
Christian, unfortunately I'm not familiar with the \
admin side of OBS. The most plausible thing I have found would be \
this settings page: \
&nbsp;https://obs.kolabsys.com/repositories/Debian:10.0 The \
mirror URLs configured there lead to a 404, though. It seems there's a \
 path component (`/dists/`) missing in the \
middle. &nbsp;Broken: \
https://mirror.switch.ch/ftp/mirror/debian/buster Working: \
https://mirror.switch.ch/ftp/mirror/debian/dists/buster Maybe \
this will suffice to trigger a download-on-demand [1] on the next \
 package \
build. Best, Christoph [1] \
https://openbuildservice.org/help/manuals/obs-user-guide/ cha.obs.concepts.html#concept_dod On \
Monday, 17 July 2023 07:12:51 CEST Christian Mollekopf wrote: <blockquote \
type="cite">On Saturday, 15 July 2023 00:04:21 CEST you \
wrote: </blockquote><blockquote type="cite"><blockquote \
type="cite">Hi all, </blockquote></blockquote><blockquote \
type="cite"><blockquote \
type="cite"> </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">if my understanding is correct, \
CVE-2022-37026 allows an \
authentication </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">bypass by clients when using \
certificate-based authentication, \
while </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">'normal' user/ password-based authentication is not \
affected. </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite"> </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">If that is indeed the case, then I believe \
our quick fix doesn't entail an </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">immediate risk to Guam \
users. </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite"> </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">Nevertheless, I do feel somewhat strongly \
about doing things the right </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">way. In our case this would \
mean: </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">1. Make OBS pull the latest Debian 10 packages, including \
erlang-base. </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">2. Revert the patch that enables ERTS bundling for \
Guam. </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">3. Rebuild Guam. </blockquote></blockquote><blockquote \
type="cite"> </blockquote><blockquote type="cite">I'd rather \
have it bundled than wake up to our packages no longer \
starting </blockquote><blockquote type="cite">because the upstream \
erts package changed, so for unbundling we need to </blockquote><blockquote \
type="cite">figure which erts version to pin first \
IMO. </blockquote><blockquote type="cite"><blockquote type="cite">I'm \
happy to take care of steps 2 and 3, but step 1 needs to be done by \
an </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">OBS admin. Christian? \
Jeroen? </blockquote></blockquote><blockquote \
type="cite"> </blockquote><blockquote type="cite">Do you happen \
to know how to trigger such an update? </blockquote><blockquote \
type="cite">I have access, but to me it seems the OBS mostly expects to build \
agains a </blockquote><blockquote type="cite">static \
repository. </blockquote><blockquote \
type="cite"> </blockquote><blockquote \
type="cite">Cheers, </blockquote><blockquote \
type="cite">Christian </blockquote><blockquote \
type="cite"> </blockquote><blockquote type="cite"><blockquote \
type="cite">Best, </blockquote></blockquote><blockquote \
type="cite"><blockquote \
type="cite">Christoph </blockquote></blockquote><blockquote \
type="cite"><blockquote \
type="cite"> </blockquote></blockquote><blockquote \
type="cite"><blockquote \
type="cite">_______________________________________________ </blockquote></blockquote><blockquote \
type="cite"><blockquote type="cite">users mailing \
list </blockquote></blockquote><blockquote type="cite"><blockquote \
type="cite">users@lists.kolab.org </blockquote></blockquote><blockquote \
type="cite"><blockquote \
type="cite">https://lists.kolab.org/mailman/listinfo/users </blockquote></blockquote><blockquote \
type="cite"> </blockquote><blockquote \
type="cite">_______________________________________________ </blockquote><blockquote \
type="cite">devel mailing list </blockquote><blockquote \
type="cite">devel@lists.kolab.org </blockquote><blockquote \
type="cite">https://lists.kolab.org/mailman/listinfo/devel </blockquot \
e> _______________________________________________ devel \
mailing list devel@lists.kolab.org https://lists.kolab.org/mailman/listinfo/devel</div></blockquote></body></html>

_______________________________________________
devel mailing list
devel@lists.kolab.org
https://lists.kolab.org/mailman/listinfo/devel

[prev in list] [next in list] [prev in thread] [next in thread] 