[debbugs-tracker] bug#26431: closed ([PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2)

[GNU bug Tracking System]

Your message dated Mon, 10 Apr 2017 23:57:37 +0200
with message-id <address@hidden>
and subject line Re: bug#26431: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
has caused the debbugs.gnu.org bug report #26431,
regarding [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
to be marked as done.

(If you believe you have received this mail in error, please contact
address@hidden)


-- 
26431: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=26431
GNU Bug Tracking System
Contact address@hidden with problems
> --- Begin Message ---
>
>
>
> Subject: 
>
> [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
>
>
>
>
> Date: 
>
> Mon, 10 Apr 2017 15:39:36 +0200
>
>
>
>
> Hello,
>
> These patches fix <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2017-7186>
> in pcre and pcre2 using the upstream patches referenced in the CVE database.
>
> Ludo'.
>
> Ludovic Courtès (2):
>   gnu: pcre2: Patch CVE-2017-7186.
>   gnu: pcre: Patch CVE-2017-7186.
>
>  gnu/local.mk                                   |  2 +
>  gnu/packages/patches/pcre-CVE-2017-7186.patch  | 55 +++++++++++++++++++++
>  gnu/packages/patches/pcre2-CVE-2017-7186.patch | 67 ++++++++++++++++++++++++++
>  gnu/packages/pcre.scm                          | 13 ++++-
>  4 files changed, 136 insertions(+), 1 deletion(-)
>  create mode 100644 gnu/packages/patches/pcre-CVE-2017-7186.patch
>  create mode 100644 gnu/packages/patches/pcre2-CVE-2017-7186.patch
>
> -- 
> 2.12.2
>
>
>
>
> --- End Message ---
> --- Begin Message ---
>
>
>
> Subject: 
>
> Re: bug#26431: [PATCH 0/2] Fix CVE-2017-7186 in pcre and pcre2
>
>
>
>
> Date: 
>
> Mon, 10 Apr 2017 23:57:37 +0200
>
>
>
>
> User-agent: 
>
> Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)
>
>
>
>
> Heya,
>
> Marius Bakke <address@hidden> skribis:
>
> > Ludovic Courtès <address@hidden> writes:
> >
> >> Hello,
> >>
> >> These patches fix <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2017-7186>
> >> in pcre and pcre2 using the upstream patches referenced in the CVE database.
> >>
> >> Ludo'.
> >>
> >> Ludovic Courtès (2):
> >>   gnu: pcre2: Patch CVE-2017-7186.
> >>   gnu: pcre: Patch CVE-2017-7186.
> >
> > Thank you for these! Please add URLs to the upstream fixes in the patch
> > headers:
> >
> > https://vcs.pcre.org/pcre?view=revision&revision=1688
> > https://vcs.pcre.org/pcre2?view=revision&revision=670
>
> Done and pushed, thanks for your quick reply!
>
> FWIW there’s still work to do on pcre:
>
>   $ ./pre-inst-env guix lint -c cve pcre pcre2
>   gnu/packages/pcre.scm:76:2: address@hidden: probably vulnerable to 
> CVE-2017-7244, CVE-2017-7245, CVE-2017-7246
>
> Ludo’.
>
>
> --- End Message ---