oss-sec mailing list archives
Re: ncurses fixes upstream
From: Mark Esler <mark.esler () canonical com>
Date: Thu, 13 Apr 2023 13:33:56 -0500
On 4/12/23 15:40, Jonathan Bar Or (JBO) wrote:
Hello oss-security, Our team has worked with the maintainer of the ncurses library (used by several software packages in Linux) to fix several memory corruption vulnerabilities. They are now fixed at commit 20230408 - see details here (https://invisible-island.net/ncurses/NEWS.html#index-t20230408) A CVE was assigned (CVE-2023-29491) - it's still under a "reserved" status. How can we ensure those fixes get deployed upstream, in major Linux distributions?
(distros maintain "downstream" versions of the ncurses "upstream")Ideally, a security patch should only include security relevant changes. If a bunch of a documentation or miscellaneous changes are added, it makes backporting difficult (i.e., the non-security relevant changes may not be desired or cause the patch to not apply cleanly to old versions of ncurses). The upstream patch is already made, but that's what I'd recommend for future patches. If there's a regression as Alice suggests, that might be a good opportunity to redo the patch format.
http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56When you publish the CVE json5, you can references the patch URL and relevant bug discussions to help downstream. Including the CVE number in the patch commit is also quite helpful.
Thank you!
Which email did you contact Canonical with? I cannot find anything recent for ncurses on security () ubuntu comWe've reached out to Arch, RedHat, Canonical and other popular distros independently.
Thanks! JBO
Current thread:
- ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 12)
- Re: ncurses fixes upstream Sam James (Apr 13)
- Re: ncurses fixes upstream Georgi Guninski (Apr 15)
- Re: ncurses fixes upstream Solar Designer (Apr 15)
- Re: ncurses fixes upstream Georgi Guninski (Apr 15)
- Re: ncurses fixes upstream alice (Apr 13)
- Re: ncurses fixes upstream Mark Esler (Apr 13)
- Re: ncurses fixes upstream Tavis Ormandy (Apr 14)
- Re: ncurses fixes upstream Carlos López (Apr 19)
- RE: [EXTERNAL] Re: [oss-security] ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 19)
- Re: ncurses fixes upstream Solar Designer (Apr 19)
- Re: ncurses fixes upstream Tavis Ormandy (Apr 20)
- Re: ncurses fixes upstream Sevan Janiyan (Apr 21)
- RE: [EXTERNAL] Re: [oss-security] ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 19)
- Re: ncurses fixes upstream Sam James (Apr 13)