Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1069279

Bug#993372: Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Wed, 1 Sep 2021 11:05:09 +0300
Adrian Bunk <bunk@debian.org> wrote:

> Control: tags 993378 moreinfo
> 
> On Tue, Aug 31, 2021 at 03:49:45PM +0100, Neil Williams wrote:
> > Package: ftp.debian.org
> > Severity: normal
> > 
> > gtkpod upstream has moved but has not had any activity for over 5
> > years.
> > 
> > When investigating the two CVEs against AtomicParsley, former
> > maintainer Matteo F. Vescovi reached out to me to suggest removal
> > of gtkpod.
> > 
> > The use case for this package seems to be declining / absent and 4
> > crash bugs are currently open.
> > 
> > Fixes for these bugs and CVEs seem unlikely to appear, it would
> > seem best to remove gtkpod from Debian at this point.  
> 
> As a user I am quite unhappy when a working package I am using is out
> of the void getting am RM bug.
> 
> With software for older hardware it is normal that upstream becomes 
> inactive, and anything other than declining usage would be a surprise.
> 
> I am also dismayed at the CVEs. At first sight the "two CVEs" might
> be for the same bug, with the fix for the first CVE not fixing the
> bug. Does manually backporting the one-character change from
> CVE-2021-37232 fix everything, even without the larger CVE-2021-37231
> refactoring?

Hi Adrian.

Sorry, No. The commit linked to CVE-2021-37232 does not even fix the
problem described as being fixed by that commit in atomicparsley, at
least in my testing using the data file supplied by upstream. I
mentioned this in the bug report against atomicparsley - 993366

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993366#5

That atomicparsley data file cannot be used to test gtkpod, only
atomicparsley itself.

As mentioned already, gtkpod is now orphaned and the maintainer who
orphaned it suggested removing the package. (The CVEs are not the only
bugs against either atomicparsley or gtkpod).

The two CVEs are not the same bug - at least not according to the
commits made upstream for the two issues in atomicparsley.

Orphaned packages are at risk of sudden removal - until and unless
someone adopts the package.

-- 
Neil Williams
=============
https://linux.codehelp.co.uk/

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library Neil Williams <codehelp@debian.org> - 2021-08-31 17:00 +0200
  Bug#993372: Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library Adrian Bunk <bunk@debian.org> - 2021-09-01 10:10 +0200
    Bug#993372: Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library Neil Williams <codehelp@debian.org> - 2021-09-01 10:40 +0200
      Bug#993372: Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library Adrian Bunk <bunk@debian.org> - 2021-09-01 11:20 +0200
        Bug#993372: Bug#993378: RM: gtkpod -- RoQA; Upstream not active, orphaned & uses a vulnerable embedded library Neil Williams <codehelp@debian.org> - 2021-09-01 11:40 +0200

csiph-web