Groups > linux.debian.bugs.dist > #1069286

Bug#907336: still relevant? revert?

Path	csiph.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!bofh.it!news.nic.it!robomod
From	Bastien ROUCARIES <roucaries.bastien+imagemagick@gmail.com>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#907336: still relevant? revert?
Date	Wed, 01 Sep 2021 11:10:01 +0200
Message-ID	<CSupP-7M6-9@gated-at.bofh.it> (permalink)
References	<wr7b5-4BR-27@gated-at.bofh.it> <CStN7-7jB-5@gated-at.bofh.it> <wr7b5-4BR-27@gated-at.bofh.it> <CStN7-7jB-5@gated-at.bofh.it>
X-Original-To	Tomas Pospisek <tpo@sourcepole.ch>, 907336@bugs.debian.org, Debian Security Team <team@security.debian.org>
X-Mailbox-Line	From debian-bugs-dist-request@lists.debian.org Wed Sep 1 09:06:17 2021
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	-2.598
Reply-To	Bastien ROUCARIES <roucaries.bastien+imagemagick@gmail.com>, 907336@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	ImageMagick Packaging Team <pkg-gmagick-im-team@lists.alioth.debian.org>
X-Debian-Pr-Message	followup 907336
X-Debian-Pr-Package	imagemagick
X-Debian-Pr-Source	imagemagick
X-Gm-Message-State	AOAM533CSkEChxV5m5MbkMdxZ2ow11JrkpcspHikqCoZgVRruGuh04gY +VJYxkdUSYf7ZXOdWdYWzj+0oXznVlbhJWOEoi0=
X-Google-SMTP-Source	ABdhPJzYDyiQmk5AtAavCFELi6q17Lax6rSyWa5C79s3Tesl36VOBabDiG/czyDzpahJob1zFI4W8IUuwDwjNDSNTb0=
X-Received	by 2002:a05:6512:b9a:: with SMTP id b26mr11808153lfv.449.1630486937842; Wed, 01 Sep 2021 02:02:17 -0700 (PDT)
MIME-Version	1.0
Content-Type	text/plain; charset="UTF-8"
Content-Transfer-Encoding	quoted-printable
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-dist@lists.debian.org> archive/latest/1676220
List-ID	<debian-bugs-dist.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-dist/>
Approved	robomod@news.nic.it
Lines	54
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Wed, 1 Sep 2021 09:01:43 +0000
X-Original-Message-ID	<CAE2SPAbgX7e0WGcMht7rVdBYUrN4fjTYCwL01OKw=yJBbt-2gA@mail.gmail.com>
X-Original-References	<153530475557.10911.1256646991558919236.reportbug@neon.citronna.de> <72fc827e-8533-36a3-984b-dcad52f2ee2@sourcepole.ch> <153530475557.10911.1256646991558919236.reportbug@neon.citronna.de> <72fc827e-8533-36a3-984b-dcad52f2ee2@sourcepole.ch>
Xref	csiph.com linux.debian.bugs.dist:1069286

Show key headers only | View raw

Le mer. 1 sept. 2021 à 08:21, Tomas Pospisek <tpo@sourcepole.ch> a écrit :
>
> Dear ImageMagick Packaging Team,
>
> Short version: is it safe today to reenable PDF/PS conversion again these
> days?
>
> Long version:
>
> Today I was affected by the problem reported in [1], notably:
>
>      convert: attempt to perform an operation not allowed by the security
>      policy `PDF' @ error/constitute.c/IsCoderAuthorized/408.
>
> When I check /etc/ImageMagick-6/policy.xml I see that plenty of
> conversions to/from (?) PDF/(E)PS* are apparently disabled by default as
> delivered by Debian. Which actually covers part of the requests in this
> (#907336) bugreport.
>
> The mentioned stackoverflow Q&A however mentions that:
>
> > Make sure ghostscript is updated kb.cert.org/vuls/id/332928
>
> Which refers to a fix in Ghostscript 9.24 which is ages ago when compared
> to the Ghostscript version 9.53 currently in Debian stable.
>
> I have *zero* insight into the issues leading to PDF/PS conversion being
> disabled in Debian and if they still are relevant and still are of
> the same concern as they were at the times before Ghostscript 9.24.
>
> Or posed differently: does it make sense to reevaluate these issues and -
> if it turns out they are of no concern any more today - could the
> respective converters be re-enabled by default again?

No it will not renable by default.

The best will be to have a debconf question and let the user accept the risk.

Postscript is turing complete so it is easy to do a DOS. it should be documented

Patch welcome


Bastien

> Thanks a lot for maintaining ImageMagick! Greetings,
> *t
>
> [1] https://stackoverflow.com/questions/52998331/imagemagick-security-policy-pdf-blocking-conversion
>

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#907336: still relevant? revert? Tomas Pospisek <tpo@sourcepole.ch> - 2021-09-01 10:30 +0200
  Bug#907336: still relevant? revert? Bastien ROUCARIES <roucaries.bastien+imagemagick@gmail.com> - 2021-09-01 11:10 +0200

csiph-web