From: Christian Dupuis <christian.dupuis@docker.com>
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.400.51.1.1\))
Subject: Re: CVE-2021-3156 version number of sudo
Date: Thu, 16 Mar 2023 13:11:22 +0100
References: <A3BBFD61-8DED-453B-8827-BCD02699C49B@docker.com>
 <20230316130832.49344745@ncopa-desktop.lan>
To: ~alpine/devel@lists.alpinelinux.org
In-Reply-To: <20230316130832.49344745@ncopa-desktop.lan>
Message-Id: <81F478D6-B6DF-4E60-AFEF-0CDE8D6A5590@docker.com>

Thanks both.=20

We are really just trying to get the version range matching correct and =
stumbled over this as our code didn=E2=80=99t understand:

1.9.5p2-r0 < 1.9.12_p2-r0

Based on the findings here, we need to support that.

Thanks for insight.

Regards, cd

> On 16. Mar 2023, at 13:08, Natanael Copa <ncopa@alpinelinux.org> =
wrote:
>=20
> On Thu, 16 Mar 2023 12:12:47 +0100
> Christian Dupuis <christian.dupuis@docker.com> wrote:
>=20
>> Hi,
>>=20
>> is it possible that there*s a typo in the version number '1.9.5p2-r0'
>> of *sudo' in CVE-2021-3156? Should the version number be
>> '1.9.5_p2-r0* instead?
>=20
> I agree that it looks like a typo, but I think it is correct.
>=20
> See:
> =
https://gitlab.alpinelinux.org/alpine/aports/-/commit/7b07d36c9c463eb0692f=
f58146f01d3dffe8c454
>=20
> Seems like we have used both `pN` and `_pN` hitorically and apk-tools =
understands both formats.
>=20
> The very first sudo commit[0] in 2008 used `pkgver=3D1.6.9_p17`.
>=20
> First time the format `pN` was used was in 2011 which did:
>=20
>    -pkgver=3D1.7.4_p5
>    +pkgver=3D1.7.4p6
>=20
> [0]: =
https://gitlab.alpinelinux.org/alpine/aports/-/commit/f0d3bff8bafec4b3da29=
1a2a71c98b69b8e170e6
> [1]: =
https://gitlab.alpinelinux.org/alpine/aports/-/commit/8ccfff342c43a790a4fa=
ebe4b0e39230023757a6
>=20
> And then it has switched back and forth over the time. We have had:
> 1.8.1p1 (commit 497df9759f3fc62b00cec59b31781b4ec89c56bf)
> 1.8.3_p1 (commit 4e7d97a25281d5639c37b72bf8a7dd351b8c513b)
> ...
> 1.8.28p1 (commit 301bbcafabd063999d60f598c47de4972be2d72f)
> ...
> 1.9.3_p1 (commit b1d8dc07ad8a9db758d5b499f3376fcad016d8c4)
> ...
> 1.9.5p1
>=20
> etc.
>=20
> The `p` in sudo seems to mean "patch" release or similar, which
> corresponds to the meaning `_p` in apk-tools. It does not mean the =
same
> as 'p' in openssl's 1.1.1p.
>=20
> So going forward we should probably stick to _p, even if we have not
> been consistent with this in the past.
>=20
> Thanks!
>=20
>>=20
>> Wondering because we are getting some reports and people seem to
>> consider the finding a false positive.
>>=20
>> Regards,
>>=20
>> Christian Dupuis
>> Docker