[OE-core] CVE-2016-3116: dropbear: X11 forwarding input not validated properly
Alexander Kanavin
alexander.kanavin at linux.intel.com
Wed Sep 14 10:31:26 UTC 2016
On 09/14/2016 01:24 PM, Sona Sarmadi wrote:
> Thanks guys for your feedbacks. I agree that by default we shouldn't upgrade package
> versions in stable branches as far as possible but sometimes we have to. If there isn't a
> suitable patch I personally prefer upgrading (only if it is minor changes) rather than
> sticking to a vulnerable version. We have done this in the past e.g. for OpenSSL (from
> 1.0.1x to 1.0.1y).
See, often the upstream does have a way to get security fixes out to
users in a way that doesn't bundle unrelated feature additions and
changes. By saying 'we should trust the upstream' I mean that we should
try to fix security in a way provided by upstream instead of doing the
backporting ourselves (where frequently we have no idea what we're
really doing because we don't know the codebase, or it's otherwise too
hard for various reasons).
> I will do some investigation to find out if https://secure.ucc.asn.au/hg/dropbear/rev/a3e8389e01ff
> is the fix for CVE-2016-3116 (by quick analysis it looks the right patch) and use that patch and NOT
> upgrade the dropbear version in krogoth !!
After looking at commit tree, I'm pretty certain that it is. And you can
just update to 2016.72 because it is the only change in that version.
Alex
More information about the Openembedded-core
mailing list