Peter Pentchev
2024-03-30 19:00:01 UTC
Reply
PermalinkSeverity: normal
Tags: bookworm
X-Debbugs-Cc: ***@packages.debian.org, ***@debian.org
Control: affects -1 + src:libarchive
User: ***@packages.debian.org
Usertags: pu
[ Reason ]
Revert a change made by the same person that smuggled
the backdoor into xz. See #1068047 for more details.
[ Impact ]
In the discussion in the upstream bugtracker, the consensus is that
the reverted change may not really introduce any vulnerability, but
still some concerns were expressed regarding some unlikely scenarios.
It might be a safer bet to revert it, just in case.
[ Tests ]
None yet.
[ Risks ]
The change reverting the previous one is straightforward, limited to
a specific piece of code (specific error logging in
the bsdtar(1) command-line tool), and changes the source code back to
using the same error reporting functions that are used elsewhere
throughout the bsdtar and libarchive source code. Thus, IMHO the risks
are negligible, if any.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Introduce a patch that uses libarchive's own error reporting functions
instead of unchecked fprintf().