Re: [Kolab-devel] Erlang security update breaks guam on Debian 10

--===============0919822574637356238==
Content-Type: multipart/signed; boundary="nextPart3586701.irdbgypaU6";
 micalg="pgp-sha256"; protocol="application/pgp-signature"

--nextPart3586701.irdbgypaU6
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"; protected-headers="v1"
From: Christoph Erhardt <[email protected]>
To: [email protected], [email protected]
Date: Sat, 15 Jul 2023 00:04:21 +0200
Message-ID: <3294519.tdWV9SEqCh@delle>
In-Reply-To: <[email protected]>
MIME-Version: 1.0

Hi all,

if my understanding is correct, CVE-2022-37026 allows an authentication bypass 
by clients when using certificate-based authentication, while 'normal' user/
password-based authentication is not affected.

If that is indeed the case, then I believe our quick fix doesn't entail an 
immediate risk to Guam users.

Nevertheless, I do feel somewhat strongly about doing things the right way. In 
our case this would mean:
1. Make OBS pull the latest Debian 10 packages, including erlang-base.
2. Revert the patch that enables ERTS bundling for Guam.
3. Rebuild Guam.

I'm happy to take care of steps 2 and 3, but step 1 needs to be done by an OBS 
admin. Christian? Jeroen?

Best,
Christoph

On Friday, 14 July 2023 16:17:42 CEST hede wrote:
> Many thanks for the short timed fix!
> 
> I think there's a reason for debian to upgrade a package (via security repo)
> so bundling the old version is indeed not a good idea. Do you have further
> plans to fix this like making guam compatible with newer erlang versions?
> 
> best regards
> hede
> _______________________________________________
> users mailing list
> [email protected]
> https://lists.kolab.org/mailman/listinfo/users


--nextPart3586701.irdbgypaU6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEwp5/nkNlccrQ2UKH4yzDBS9Gs8IFAmSxxmUACgkQ4yzDBS9G
s8KxOw//VZ/+BrM+kFDHwFSL9rm3E2DODsWH4tI0w5YsL9vPwUW3REynfTZZczp6
CF3mlPxAOlc8uSeu6vc6J7bUUz+jW+O97RsH+02k62hhNnuB3dWeF4rgFQLSCdzd
ttS4R9tpIxSg5HWoqOhmqp1OxGPJGBYKtnm/mYXAoO9nVP7NsWhsOT0+5PTbHiO3
fGOtn3v4a3g3cBr/bW79d+hlhxW+D3tHsjxB9AT6AqSydp4EqvEVG6jdx0mBkCwz
4ecl2R4CjMCWuOgjFC3xhV80Y8qmkaVqeu87TXaAOoLokkLEKcG03ehDEWAl9Xro
xD35OdpZpj6nHyu9UtLnzgnphNUuKBMJVOnmOEKaAgCviZsOWus+pLlxlAIg5A9/
1VdSdK0g2SOl9DcklkQbEvNhwhW1kxuwDq6Hu8gkdyRh0S0tqDeClzJIuMbmHKAf
c6p3CVT/ktAYh0r4lhEn35gIzwE/CQUZet4PM+PenOROhyRoVT3CT3kOlj049oih
o6pv/97Illdr/VLmlHR9T6RftcWqb00TDR9jzVk6bVauk3ZmMRK79tAWQ0xGZU5d
eK8EfRN24fEvA0zFvcPLQbU9ZyA3XrIYGqEcXNRSm1/o9Nb+SdF7YWrqPRJKeHFS
DQrXNXxu9BMIlu9vIBeHMIOYXN2JG0Ca+/m4ztC20/zeJz0NHsM=
=126f
-----END PGP SIGNATURE-----

--nextPart3586701.irdbgypaU6--


--===============0919822574637356238==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
devel mailing list
[email protected]
https://lists.kolab.org/mailman/listinfo/devel
--===============0919822574637356238==--