Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From: Olek Wojnar <olek@debian.org>
Newsgroups: linux.debian.maint.java
Subject: Re: Release Critical Security Bug in Bazel Dependency
Date: Mon, 31 May 2021 22:50:02 +0200
Message-ID: <CkX1f-7nx-3@gated-at.bofh.it>
References: <CkwDL-8rs-3@gated-at.bofh.it> <CkLCO-BQ-5@gated-at.bofh.it>
X-Original-To: Debian Bazel Discussion List <debian-bazel@lists.debian.org>
X-Mailbox-Line: From debian-java-request@lists.debian.org  Mon May 31 20:45:09 2021
Old-Return-Path: <olekw.dev@gmail.com>
X-Amavis-Spam-Status: No, score=-4.5 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=2, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=no autolearn_force=no
X-Policyd-Weight: using cached result; rate: -5.5
X-Gm-Message-State: AOAM530EO4YEhyom08YTQ6QGFY5p9eNJV+FqJ4V4H0UJk+DWeqrJh55H mlZSN5IJV0GyYvLoGQHxKuAPuR0qxg8=
X-Google-SMTP-Source: ABdhPJzBVNsHdb/k5iLbQwZ97KBdBKBC/RZI0+eL50I+daO6/JtvUL8pLsVz2sExWZO3j4Zqko7uJA==
X-Received: by 2002:a0c:cdc9:: with SMTP id a9mr12031877qvn.51.1622492864630; Mon, 31 May 2021 13:27:44 -0700 (PDT)
X-Received: by 2002:a0c:ef52:: with SMTP id t18mr7896800qvs.49.1622492864146; Mon, 31 May 2021 13:27:44 -0700 (PDT)
MIME-Version: 1.0
X-Gmail-Original-Message-ID: <CAJj0crTEGEYrxo2n+TpYSyWHXEzpA9oP1-KhMX5Wovq12sH9mg@mail.gmail.com>
Content-Type: multipart/alternative; boundary="000000000000d1732005c3a60ea4"
X-Mailing-List: <debian-java@lists.debian.org> archive/latest/22835
List-ID: <debian-java.lists.debian.org>
List-URL: <https://lists.debian.org/debian-java/>
List-Archive: https://lists.debian.org/msgid-search/CAJj0crTEGEYrxo2n+TpYSyWHXEzpA9oP1-KhMX5Wovq12sH9mg@mail.gmail.com
Approved: robomod@news.nic.it
Lines: 53
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
X-Original-Cc: Debian Java List <debian-java@lists.debian.org>
X-Original-Date: Mon, 31 May 2021 16:27:08 -0400
X-Original-Message-ID: <CAJj0crTEGEYrxo2n+TpYSyWHXEzpA9oP1-KhMX5Wovq12sH9mg@mail.gmail.com>
X-Original-References: <ec72d35a-6506-ea07-e6b7-28c5b6b73537@debian.org> <CAOZBPs62t4g_WvCUW-F32apO5qyKbykTBE+CztOOkMxGFa3Veg@mail.gmail.com>
Xref: csiph.com linux.debian.maint.java:12197

--000000000000d1732005c3a60ea4
Content-Type: text/plain; charset="UTF-8"

Hi Yun,

On Mon, May 31, 2021 at 4:17 AM Yun Peng <pcloudy@google.com> wrote:

> Thanks, Olek!
>
> Looks like the bug is fixed in the latest release of google-oauth-client.
> Does this mean we just need to upgrade its version in Debian?
>
> Please let me know if I can help with anything!
>

Thanks for the offer but it was fairly straightforward. Unfortunately, we
typically can't upload new upstream versions when we're in a release
freeze. But it was easy enough to backport the upstream fix to version
1.28.0. I think I only had to make one minor tweak to the pom.xml due to
some additions for a later version. After that it built perfectly.

I also rebuilt the google-api-client-java and bazel-bootstrap packages
locally against the new google-oauth-client-java and everything looks good.
I've filed an unblock bug with the Release Team to allow the fix to migrate
to bullseye. Now we just wait. :)

-Olek

--000000000000d1732005c3a60ea4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi Yun,</div><br><div class=3D"gmail_quot=
e"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, May 31, 2021 at 4:17 AM Yu=
n Peng &lt;<a href=3D"mailto:pcloudy@google.com">pcloudy@google.com</a>&gt;=
 wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr">Thanks, Olek!<div><br></div><div>Looks like the bug is fixed in th=
e latest release of google-oauth-client. Does this mean we just need to upg=
rade its version in Debian?</div><div><br></div><div>Please=C2=A0let me kno=
w if I can help with anything!</div></div></blockquote><div><br></div><div>=
Thanks for the offer but it was fairly straightforward. Unfortunately, we t=
ypically can&#39;t upload new upstream versions when we&#39;re in a release=
 freeze. But it was easy enough to backport the upstream fix to version 1.2=
8.0. I think I only had to make one minor tweak to the pom.xml due to some =
additions for a later=C2=A0version. After that it built perfectly.</div><di=
v><br></div><div>I also rebuilt the google-api-client-java and bazel-bootst=
rap packages locally against the new google-oauth-client-java and everythin=
g looks good. I&#39;ve filed an unblock bug with the Release Team to allow =
the fix to migrate to bullseye. Now we just wait. :)</div><div><br></div><d=
iv>-Olek</div></div></div>

--000000000000d1732005c3a60ea4--