Precedence: list
MIME-Version: 1.0
In-Reply-To: <CAMgJUL2X6tTPDJZSnciPOgL9g4p1ix1FxeqPsWniVytO9ctnow@mail.gmail.com>
References: <CAMgJUL2X6tTPDJZSnciPOgL9g4p1ix1FxeqPsWniVytO9ctnow@mail.gmail.com>
From: Leonardo Arena <rnalrd@gmail.com>
Date: Tue, 17 Apr 2018 17:01:44 +0200
Message-ID: <CAGG_d8BsZQ1O5A2-ARmX4VjZGiMBVGMH2-475+rz_7YnXoAeuQ@mail.gmail.com>
Subject: Re: [alpine-devel] Patching CVE-2016-4074 in jq
To: Ariel Zelivansky <ariel@twistlock.com>
Cc: Alpine-devel <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary="f403045e36d0eb615b056a0c9d4b"

--f403045e36d0eb615b056a0c9d4b
Content-Type: text/plain; charset="UTF-8"

Hi,

On Tue, Apr 17, 2018 at 3:07 PM, Ariel Zelivansky <ariel@twistlock.com>
wrote:

> Hi,
>
> It has been brought to my attention that the current jq package in alpine
> is vulnerable to CVE-2016-4074
> <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4074>.
>


thank you for bringing this to our attention. This has been now fixed in
edge. I'll see if it can be backported to stable branches too.


>
> The fix for this issue was released a while back on their master branch
> but no one packaged it into release. On the project website
> <https://stedolan.github.io/jq/> the latest jq release is 1.5, which was
> released more than two years ago. It is vulnerable to this CVE.
>
> It is worth mentioning someone on the project GitHub someone released
> 1.6rc1 last year and it includes the fix for this issue. You might want to
> consider packaging this release but I am not very familiar with the jq
> release process or found any documentation of it.
>
> The alpine jq package
> <https://git.alpinelinux.org/cgit/aports/tree/main/jq/APKBUILD> patches
> CVE-2015-8863 so I think it should also patch this issue for the meanwhile.
> You can see the correspondence on this issue
> <https://github.com/stedolan/jq/issues/1136> and the fix
> <https://github.com/stedolan/jq/commit/83e2cf607f3599d208b6b3129092fa7deb2e5292#diff-6bc4fa2c743f03adaf36dcc09acaaba2>
> .
>
>
This was fixed in 1.5-r1 package.

Best regards,

/eo

--f403045e36d0eb615b056a0c9d4b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><div><div class=3D"gmail_extra"><br><div class=3D"g=
mail_quote">On Tue, Apr 17, 2018 at 3:07 PM, Ariel Zelivansky <span dir=3D"=
ltr">&lt;<a href=3D"mailto:ariel@twistlock.com" target=3D"_blank">ariel@twi=
stlock.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=
=3D"ltr">Hi,<div><br></div><div>It has been brought to my attention that th=
e current jq package in alpine is vulnerable to=C2=A0<a href=3D"https://cve=
.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2016-4074" target=3D"_blank">CVE-=
2016-4074</a>.</div></div></blockquote><div><br><br></div><div>thank you fo=
r bringing this to our attention. This has been now fixed in edge. I&#39;ll=
 see if it can be backported to stable branches too.<br></div><div>=C2=A0</=
div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><br></div><div>The=
 fix for this issue was released a while back on their master branch but no=
 one packaged it into release. On the <a href=3D"https://stedolan.github.io=
/jq/" target=3D"_blank">project website</a>=C2=A0the latest jq release is 1=
.5, which was released more than two years ago. It is vulnerable to this CV=
E.</div><div><br></div><div>It is worth mentioning someone on the project G=
itHub someone released 1.6rc1 last year and it includes the fix for this is=
sue. You might want to consider packaging this release but I am not very fa=
miliar with the jq release process or found any documentation of it.</div><=
div><br></div><div>The alpine <a href=3D"https://git.alpinelinux.org/cgit/a=
ports/tree/main/jq/APKBUILD" target=3D"_blank">jq package</a>=C2=A0patches =
CVE-2015-8863 so I think it should also patch this issue for the meanwhile.=
 You can see the=C2=A0<a href=3D"https://github.com/stedolan/jq/issues/1136=
" target=3D"_blank">correspondence on this issue</a> and <a href=3D"https:/=
/github.com/stedolan/jq/commit/83e2cf607f3599d208b6b3129092fa7deb2e5292#dif=
f-6bc4fa2c743f03adaf36dcc09acaaba2" target=3D"_blank">the fix</a>.</div><di=
v><br></div></div></blockquote><div><br></div><div>This was fixed in 1.5-r1=
 package.<br><br></div><div>Best regards,<br><br></div><div>/eo<br></div></=
div></div></div></div>

--f403045e36d0eb615b056a0c9d4b--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---