Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171437 > unrolled thread

Recent flex security announcement

Back to article view | Back to linux.debian.user

Contents

  Recent flex security announcement Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 02:20 +0200
    Re: Recent flex security announcement Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-26 14:20 +0200
      Re: Recent flex security announcement Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 14:50 +0200
        Re: Recent flex security announcement Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-26 15:00 +0200
          Re: Recent flex security announcement Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 15:50 +0200

#171437 — Recent flex security announcement

[Multipart message — attachments visible in raw view] — view raw

I have a feeling I'm about to embarrass myself by displaying either
ignorance or a failure to spot the obvious, but here goes...

The other day there was a Debian security advisory about the flex package.
In my Debian machines, the fix can be installed by the usual apt commands.

However I also have Linux machines that don't use a package management
system, and there I also have a version of flex with the vulnerability, so
I wanted to get the source tarball of the fixed version (v2.6.1) so I could
build it for there too.

And the only place I can find 2.6.1 is on debian's package website. The
latest version the upstream site (source forge) has is v2.6.0 which as I
understand it has the vulnerability.

Anyone know what the deal is here?

Mark

[toc] | [next] | [standalone]

#171447

On Fri, Aug 26, 2016 at 12:11:30AM +0000, Mark Fletcher wrote:
> However I also have Linux machines that don't use a package management
> system, and there I also have a version of flex with the vulnerability, so
> I wanted to get the source tarball of the fixed version (v2.6.1) so I could
> build it for there too.

Debian security fixes in stable (or oldstable/LTS) releases aren't done
by switching to a new upstream version.  They're done by backporting the
smallest possible fix to the same version that stable (or oldstable/LTS)
is already using.

The current Debian version of flex in stable is 2.5.39-8+deb8u1.
This means it's based on upstream version 2.5.39, with a bunch of
Debian-specific changes/patches applied to it.

If you want to obtain the Debian-patched source and then build it on
another system, then you have two options.  The first is to use the
"apt-get source" command on a Debian system.  This will retrieve the
three files that constitute a Debian source package, extract the upstream
tarball, and apply the Debian patches to it.  You will be left with
an extracted & patched directory, ready to build, assuming your target
system has all of the tools needed to build it.

The second is to mimic that process yourself.  Go to the package's page
(e.g. https://packages.debian.org/jessie/flex) and look on the right hand
side, where it says "Download Source Package".  Under that, you will see
the three files (.dsc and .orig.tar.gz and .debian.tar.xz).  Download all
three of those (or you can skip the .dsc file, but not the other two).
Extract the .orig.tar.gz file, and then cd into the directory it creates.
>From there, extract the .debian.tar.xz file.  This will create a debian/
subdirectory with patches in it.  Apply those patches manually.  Now you
should, in theory, have the same patched-and-ready-to-build directory
that you would have got from apt-get source.

[toc] | [prev] | [next] | [standalone]

#171451

[Multipart message — attachments visible in raw view] — view raw

On Fri, Aug 26, 2016 at 9:19 PM Greg Wooledge <wooledg@eeg.ccf.org> wrote:

> On Fri, Aug 26, 2016 at 12:11:30AM +0000, Mark Fletcher wrote:
> > However I also have Linux machines that don't use a package management
> > system, and there I also have a version of flex with the vulnerability,
> so
> > I wanted to get the source tarball of the fixed version (v2.6.1) so I
> could
> > build it for there too.
>
> Debian security fixes in stable (or oldstable/LTS) releases aren't done
> by switching to a new upstream version.  They're done by backporting the
> smallest possible fix to the same version that stable (or oldstable/LTS)
> is already using.
>
> The current Debian version of flex in stable is 2.5.39-8+deb8u1.
> This means it's based on upstream version 2.5.39, with a bunch of
> Debian-specific changes/patches applied to it.
>
> If you want to obtain the Debian-patched source and then build it on
> another system, then you have two options.  The first is to use the
> "apt-get source" command on a Debian system.  This will retrieve the
> three files that constitute a Debian source package, extract the upstream
> tarball, and apply the Debian patches to it.  You will be left with
> an extracted & patched directory, ready to build, assuming your target
> system has all of the tools needed to build it.
>
> The second is to mimic that process yourself.  Go to the package's page
> (e.g. https://packages.debian.org/jessie/flex) and look on the right hand
> side, where it says "Download Source Package".  Under that, you will see
> the three files (.dsc and .orig.tar.gz and .debian.tar.xz).  Download all
> three of those (or you can skip the .dsc file, but not the other two).
> Extract the .orig.tar.gz file, and then cd into the directory it creates.
> From there, extract the .debian.tar.xz file.  This will create a debian/
> subdirectory with patches in it.  Apply those patches manually.  Now you
> should, in theory, have the same patched-and-ready-to-build directory
> that you would have got from apt-get source.
>

Yep, thanks. My question isn't "how do I get the patched source of
stable?", it is "why can't I see the source tarball of the version that is
in stretch / sid anywhere except on Debian's (and now Arch's as well)
package site?"

Stretch and sid are quoting version 2.6.1 and I can't see where they got
that from, as upstream (sourceforge) latest version seems to be 2.6.0. And
2.6.1 claims to be the version with the fix.

Maybe I presented my situation in a confusing way to start with. I run a
Jessie box which includes security updates. My regular weekend updates will
take care of installing the security fix for my Jessie box. But I also run
an LFS machine which of course I have to take care of package updates for
myself. Debian security updates are a really good way for me to become
aware of situations when I should be considering updating packages on my
LFS box. This one for flex caught my eye so I checked what version I had on
my LFS box and it was 2.6.0. According to the Debian security advisory, the
fixed upstream version is 2.6.1, and that is what is in stretch and sid
right now. So I trotted off to Sourceforge to get the upstream v2.6.1
and... couldn't find it. The latest version offered there is v2.6.0.

So I can get the 2.6.1 source tarball by downloading the source package
from ftp.jp.debian.org (my local mirror), and indeed have already done so,
but I am hoping to understand why I can't see a version 2.6.1 in upstream,
and therefore where the Debian 2.6.1 came from.

Also, I appreciate your consideration in cc'ing me on your reply, but it is
not necessary as I am subscribed to the list.

Thanks

Mark

[toc] | [prev] | [next] | [standalone]

#171452

On Fri, Aug 26, 2016 at 12:41:54PM +0000, Mark Fletcher wrote:
> Stretch and sid are quoting version 2.6.1 and I can't see where they got
> that from, as upstream (sourceforge) latest version seems to be 2.6.0. And
> 2.6.1 claims to be the version with the fix.

*sigh* ... it just figures, as soon as you ask this, I cannot reach
http://ftp.gnu.org/ or https://ftp.gnu.org/ to look at the actual
versions.

Nor can I reach http://www.gnu.org/.  Nor can I ping either site.
Looks like they're just totally down.

However, https://packages.debian.org/stretch/flex does have a
flex_2.6.1.orig.tar.gz on it.  That's what Debian is using as their
upstream tarball, wherever it came from.  And in theory, the copyright
file should say where they got it from.

[toc] | [prev] | [next] | [standalone]

#171459

[Multipart message — attachments visible in raw view] — view raw

On Fri, Aug 26, 2016 at 9:52 PM Greg Wooledge <wooledg@eeg.ccf.org> wrote:

> On Fri, Aug 26, 2016 at 12:41:54PM +0000, Mark Fletcher wrote:
> > Stretch and sid are quoting version 2.6.1 and I can't see where they got
> > that from, as upstream (sourceforge) latest version seems to be 2.6.0.
> And
> > 2.6.1 claims to be the version with the fix.
>
> *sigh* ... it just figures, as soon as you ask this, I cannot reach
> http://ftp.gnu.org/ or https://ftp.gnu.org/ to look at the actual
> versions.
>
> Nor can I reach http://www.gnu.org/.  Nor can I ping either site.
> Looks like they're just totally down.
>
> However, https://packages.debian.org/stretch/flex does have a
> flex_2.6.1.orig.tar.gz on it.  That's what Debian is using as their
> upstream tarball, wherever it came from.  And in theory, the copyright
> file should say where they got it from.
>

Aha! Mystery solved!

Sourceforge isn't the home for the project any more. It's now hosted at
https://github.com/westes/flex/releases

And there, in all its glory, is release 2.6.1.

Interestingly Google is still giving the old Sourceforge home first in
search results.

It did wander through my head yesterday that Sourceforge might not be the
home for the project any more, but Google seemed so sure... :)

Anyway thanks for the help Greg.

Mark

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web