Processed: bookworm-pu: package freerdp2/2.11.2+dfsg1-1~deb12u1

[Debian Bug Tracking System]

affects -1 + src:freerdp2

Bug #1054915 [release.debian.org] bookworm-pu: package freerdp2/2.11.2+dfsg1-1~deb12u1
Added indication that 1054915 affects src:freerdp2

[Debian Bug Tracking System]

tag -1 moreinfo

Bug #1054915 [release.debian.org] bookworm-pu: package freerdp2/2.11.2+dfsg1-1~deb12u1
Added tag(s) moreinfo.

[Jonathan Wiltshire]

Control: tag -1 moreinfo

Hi,

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing
also a few bugs that would be nice to be fixed.

It's a balancing act, as always. I'm OK with new upstream releases if they
are small enough to sensibly review (or an upstream with a good trusted
history, which I don't yet have for freerdp2). If you think a new upstream
is reasonable, let's see how it looks.

Either way we need a source debdiff please.

Thanks,

[Salvatore Bonaccorso]

Hi Tobi,

Post by Jonathan Wiltshire
Control: tag -1 moreinfo
Hi,

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing
also a few bugs that would be nice to be fixed.

It's a balancing act, as always. I'm OK with new upstream releases if they
are small enough to sensibly review (or an upstream with a good trusted
history, which I don't yet have for freerdp2). If you think a new upstream
is reasonable, let's see how it looks.
Either way we need a source debdiff please.

Did you saw the followup question from Jonathan?

Regards,
Salvatore

[Salvatore Bonaccorso]

Hi Tobi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Jonathan Wiltshire
Control: tag -1 moreinfo
Hi,

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing
also a few bugs that would be nice to be fixed.

It's a balancing act, as always. I'm OK with new upstream releases if they
are small enough to sensibly review (or an upstream with a good trusted
history, which I don't yet have for freerdp2). If you think a new upstream
is reasonable, let's see how it looks.
Either way we need a source debdiff please.

Did you saw the followup question from Jonathan?

Friendly ping :). Note we are late for the 12.7 point release now, but
it still should ideally make it for 12.8.

Regards,
Salvatore

[Salvatore Bonaccorso]

Hi Tobi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Jonathan Wiltshire
Control: tag -1 moreinfo
Hi,

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing
also a few bugs that would be nice to be fixed.

It's a balancing act, as always. I'm OK with new upstream releases if they
are small enough to sensibly review (or an upstream with a good trusted
history, which I don't yet have for freerdp2). If you think a new upstream
is reasonable, let's see how it looks.
Either way we need a source debdiff please.

Did you saw the followup question from Jonathan?

Friendly ping :). Note we are late for the 12.7 point release now, but
it still should ideally make it for 12.8.

Friendly ping (but I guess we might miss again 12.9 now for it as
window for next point release is closing upcoming weekend already).

it would be good to see those CVEs addressed in a point release for
bookworm.

Regards,
Salvatore

[Tobias Frost]

Hi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Salvatore Bonaccorso
Hi Tobi,

Post by Jonathan Wiltshire
Control: tag -1 moreinfo
Hi,

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing
also a few bugs that would be nice to be fixed.

It's a balancing act, as always. I'm OK with new upstream releases if they
are small enough to sensibly review (or an upstream with a good trusted
history, which I don't yet have for freerdp2). If you think a new upstream
is reasonable, let's see how it looks.
Either way we need a source debdiff please.

Did you saw the followup question from Jonathan?

Friendly ping :). Note we are late for the 12.7 point release now, but
it still should ideally make it for 12.8.

Friendly ping (but I guess we might miss again 12.9 now for it as
window for next point release is closing upcoming weekend already).
it would be good to see those CVEs addressed in a point release for
bookworm.

Yes, sorry, slipped again through the cracks. I'll try / will be able to work
on this probably tomorrow and can reserve next weekend for it. (Currently in
the train back from Congress, so cannot jump into it right now)

Said that, I'll need an indication of thumbs up / down for the change
before putting significant work into it, as the patch has quite some size
(but the individual changes seems quite isolated and not lots of significant
rewrites) and I think the only sensible way is to do testing applications which
are using freerdp2, as I did for LTS/ELTS back then.

Upstream has moved to 2.11.7 in the mean time, and as upstream says it
fixes some problems found by fuzzing I think this is version we want
too. This version is in unstable already since 2024-07-15, so I
think any significant problems would have been reported since then.
On top, 2.11.7-dsfg2-4 seems to employ the upstream test suite. I've not
checked the details of the test suite in autopkgtest, but at least this sounds
promising.

The patch is a bit shy of 8000 lines.

I've attached the diff, it can be obtained from git (salsa) as well for those
prefering an UI:
https://salsa.debian.org/debian-remote-team/freerdp2/-/compare/debian%2F2.10.0+dfsg1-1...debian%2F2.11.7+dfsg1-6


diff on the upstream changelog (omitting the part fixing typos)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,97 @@
+# 2024-04-22 Version 2.11.7
+
+Noteworthy changes:
+* Backported oss-fuzz fixes
+
+For a complete and detailed change log since the last release run:
+git log 2.11.7...2.11.6
+
+# 2024-04-17 Version 2.11.6
+
+CVE:
+ CVE-2024-32041 [Low[ OutOfBound Read in zgfx_decompress_segment
+ CVE-2024-32039 [Moderate] Integer overflow & OutOfBound Write in clear_decompress_residual_data
+ CVE-2024-32040 [Low] integer underflow in nsc_rle_decode
+ CVE-2024-32458 [Low] OutOfBound Read in planar_skip_plane_rle
+ CVE-2024-32459 [Low] OutOfBound Read in ncrush_decompress
+ CVE-2024-32460 [Low] OutOfBound Read in interleaved_decompress
+
+Noteworthy changes:
+* Backported #10077
+
+For a complete and detailed change log since the last release run:
+git log 2.11.6...2.11.5
+
+# 2024-01-19 Version 2.11.5
+
+Noteworthy changes:
+* Fix integer overflow in progressive decoder
+* Update OpenSSL API usage for compatiblility with newer versions (#9747)
+* Prevent NULL dereference for single thread decoder (#9712)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.5...2.11.4
+
+# 2023-12-14 Version 2.11.4
+
+Notworthy changes:
+* fix a typo in unicode commit (#9652)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.4...2.11.3
+
+# 2023-12-14 Version 2.11.3
+
+Notworthy changes:
+* Disabled windows MEDIA FOUNDATION h264 decoder due to reported issues (#9469)
+* Fix issues with drive redirection (#9530,9554, #9586, #9617)
+* Use endian safe ICU string converter (#9631)
+* Improve AAC support (#9577)
+* Fix swiss german keyboard layout (#9560)
+* Enable rfx-mode:image (#9428)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.3...2.11.2
+
+# 2023-09-20 Version 2.11.2
+
+Notworthy changes:
+* Backported #9378: backported wArrayList (optional) copy on insert
+* Backported #9360: backported certificate algorithm detection
+
+For a complete and detailed change log since the last release run:
+git log 2.11.2...2.11.1
+
+# 2023-09-04 Version 2.11.1
+
+Notworthy changes:
+* Backported #9356: Fix issues with order updates
+
+For a complete and detailed change log since the last release run:
+git log 2.11.1..2.11.0
+
+# 2023-08-28 Version 2.11.0
+
+Noteworthy changes:
+* Various input validation fixes
+* Added various CMake options #9317
+* LibreSSL build fixes #8709
+
+Fixed issues:
+* Backported #9233: Big endian support
+* Backported #9099: Mouse grabbing support
+* Backported #6851: wayland scrolling fix
+* Backported #8690: Update h264 to use new FFMPEG API
+* Backported #7306: early bail from update_read_window_state_order breaks protocol
+* Backported #8903: rdpecam/server: Remove wrong assertion
+* Backported #8994: bounds checks for gdi/gfx rectangles
+* Backported #9023: enforce rdpdr client side state checks
+* Backported #6331: deactivate mouse grabbing by default
+* Cherry-pick out of #9172: channels/cliprdr: Fix writing incorrect PDU type for unlock PDUs
+
# 2023-02-16 Version 2.10.0

Post by Salvatore Bonaccorso
Regards,
Salvatore

[Debian Bug Tracking System]

retitle -1 bookworm-pu: package freerdp2/2.11.7+dfsg1-6~deb12u1

Bug #1054915 [release.debian.org] bookworm-pu: package freerdp2/2.11.2+dfsg1-1~deb12u1
Changed Bug title to 'bookworm-pu: package freerdp2/2.11.7+dfsg1-6~deb12u1' from 'bookworm-pu: package freerdp2/2.11.2+dfsg1-1~deb12u1'.

tags -1 -moreinfo

Bug #1054915 [release.debian.org] bookworm-pu: package freerdp2/2.11.7+dfsg1-6~deb12u1
Removed tag(s) moreinfo.

[Tobias Frost]

Control: retitle -1 bookworm-pu: package freerdp2/2.11.7+dfsg1-6~deb12u1
Control: tags -1 -moreinfo

Dear Release Team,

Attached is a full source diff.

I'm moving the target version to 2.11.7, as packaged previously as
2.11.7+dfsg1-6 as new CVEs were discovered and fixed with this version.

Since 2.10.0+dfsg1-1, the version currently in stable, those CVEs will
be fixed with the 2.11.7+dfsg1-6: 
CVE-2024-32661 CVE-2024-32660 CVE-2024-32659 CVE-2024-32658
CVE-2024-32460 CVE-2024-32459 CVE-2024-32458 CVE-2024-32041
CVE-2024-32040 CVE-2024-32039 CVE-2024-22211 CVE-2023-40589
CVE-2023-40569 CVE-2023-40188 CVE-2023-40186 CVE-2023-40181
CVE-2023-39356 CVE-2023-39354 CVE-2023-39353 CVE-2023-39352
CVE-2023-39351 CVE-2023-39350

As said in the initial mail: 

Backporting the fixes is of course possible, but bears a significant
risk for regression, therefor I would prefer to use the new upstream
version, given also that upstream changes are only a few and fixing also
a few bugs that would be nice to be fixed.

As far as I understood it, the maintainers would also prefer the new
version over patching the one in stable. (They are in CC, so can
intervene if I got that wrong
)

The version 2.11.7 has been in unstable since 2024-07-15, in testing
since 2024-10-07, so the new upstream version has been seen some
testing. (it now has been removed from unstable for freerdp3, #1090342)
Looking at the BTS I don't see reported regressions as well.

It seems to me that the 2.x series only get (significant) bug fixes and
security updates; new features seems only to go into FreeRDP 3.x.

To assess the risks, I did an extensive triage of the changes, looking
at the actual git commits in the version range; (this seems to confirm
that 2.x only gets fixes and security updates)


Triaging upstream changes:

2.10.0 -> 2.11.0 is the most significant changeset with 52 commits, see
below.

2.11.x (upstream branch stable-2.0) seems to be focusing on bugfixes and
security fixes. Looking at the upstream changelog [1]:

[1] https://github.com/FreeRDP/FreeRDP/blob/stable-2.0/ChangeLog

I see for 
- 2.11.7 [2] just fixes, including one potential out of bound read.

should fix: CVE-2024-32658 to 60.

- 2.11.6 [3] is targeting CVE-2024-32039 to 41, CVE-2024-32458 to 60
(out of bound reads, Integer overflow) and a bugfix backported from 
3.5.0 (upstream PR#[10077], which are adding additional input lenght
  checks and fix an integer overflow)

- 2.11.5 [4] another integer overflow, previnting deref of NULL, and a
compatiblity fix for newer OpenSSL [4a], with an version guard for
  OpenSSL >3, so I guess we want this fix too.
via security tracker: CVE-2024-22211

- 2.11.4 [5] is a FTBFS fix of 2.11.3, sinlge important commit.

- 2.11.3 [6] is a version that have more noteworthy changes:
("->" are my comments)

* Disabled windows MEDIA FOUNDATION h264 decoder due to reported
issues (#9469)
-> this is Windows only.

* Fix issues with drive redirection (#9530,9554, #9586, #9617)
-> bugfix to fix several error cases when connecting 
(upstream issue #9506 explains the context)

* Use endian safe ICU string converter (#9631)
-> fix for issue observed on big-endian machines, introduced with
 2.11.0, upstream bug #9616)

* Improve AAC support (#9577)
-> bugfixes the AAC encoder, when a ffmpeg conversion yields NaN or 
infinity. Details upstream bug #9576.

* Fix swiss german keyboard layout (#9560)
-> bugfix for not encoding umlauts correctly. (details upstream
bug #9560)

* Enable rfx-mode:image (#9428)
-> bugfix for rfx-mode:image (details upstream bug #9425)

There seems to be more smaller commits that aid to improve
compatiblity or avoid race conditions ( e.g message order.)
I'd say those are bugfixes. One change is a small feature to
remember audio volume when reconnecting, I could imagine that could
save a few eardrums :))

- 2.11.2 [7] has two changes, both backported from FreeRDP3
- more robus OpenSSL certificate hash algorithm detection. [7a]
- regression fix, bug introduced with 2.11.1 (upstream issue #9377)
[7b]

- 2.11.1 [8] single change, bugfix see [8a],
Regression fix for CVE-2023-39356

- 2.11.0 [9] is the biggest changeset:

Noteworthy changes:
* Various input validation fixes
* Added various CMake options #9317
-> refactoring of CMakeLists.txt, should not have an effect on the
  build results.
* LibreSSL build fixes #8709
-> fix only for LibreSSL. (gated by #if .. #endif)

Fixed issues:
* Backported #9233: Big endian support
-> bugfix
* Backported #9099: Mouse grabbing support
-> PR title: mouse move restrict, seems feature related to mouse
 grabbing.
* Backported #6851: wayland scrolling fix
-> bugfix for wayland.
* Backported #8690: Update h264 to use new FFMPEG API
-> add #if-guards against FFPEG version, to use h264 api on new
 enough ffmpeg (>59.18.100), which is not the case on stable.
(LIBAVUTIL_VERSION_MAJOR is 57 on my bookworm VM)
* Backported #7306: early bail from update_read_window_state_order
breaks protocol
-> bugfix.
* Backported #8903: rdpecam/server: Remove wrong assertion
-> bugfix, avoids crash when asserts are enabled.
* Backported #8994: bounds checks for gdi/gfx rectangles
-> bugfix, potential security impact.
* Backported #9023: enforce rdpdr client side state checks
-> bugfix
* Backported #6331: deactivate mouse grabbing by default
-> support command line option "grab-mouse"
* Cherry-pick out of #9172: channels/cliprdr: Fix writing incorrect
PDU type for unlock PDUs
-> bugfix, cherry-picked from FreeRDP3.

according to the security-tracker 2.11.0 fixes:
CVE-2023-39350 to 54, CVE-2023-39356, CVE-2023-40181, CVE-2023-40186
CVE-2023-40188, CVE-2023-40567, CVE-2023-40569, CVE-2023-40589


[2] https://github.com/FreeRDP/FreeRDP/compare/2.11.6...2.11.7
[3] https://github.com/FreeRDP/FreeRDP/compare/2.11.5...2.11.6
[4] https://github.com/FreeRDP/FreeRDP/compare/2.11.4...2.11.5
[4a] https://github.com/FreeRDP/FreeRDP/commit/d3f62748c6662ce03
[5] https://github.com/FreeRDP/FreeRDP/compare/2.11.3...2.11.4
namely: https://github.com/FreeRDP/FreeRDP/commit/52663d581cb
[6] https://github.com/FreeRDP/FreeRDP/compare/2.11.2...2.11.3
[7] https://github.com/FreeRDP/FreeRDP/compare/2.11.1...2.11.2
[7a] https://github.com/FreeRDP/FreeRDP/commit/e93433fb21231db
[7b] https://github.com/FreeRDP/FreeRDP/commit/0472543b019d01280
[8] https://github.com/FreeRDP/FreeRDP/compare/2.11.0...2.11.1
[8a] https://github.com/FreeRDP/FreeRDP/commit/23db2f4e6ba71f1c1
[9]https://github.com/FreeRDP/FreeRDP/compare/2.10.0...2.11.0

[10077] https://github.com/FreeRDP/FreeRDP/pull/10077/commits


Debian packaging changes:

The proposed packaging is based on the last version from testing,
2.11.7+dfsg1-6, but reverting the changes for:
- t64 changes
- turning off Keberos support, as it was not available in bookworm as
well.
- Using pkg-config instead of pkgconf, as the current bookworm package
does.
- not applying the ffmpeg7 compatibility patch, as its not needed for
 bookworm.

A diff generated by git diff debian/2.11.7+dfsg1-6 is attached as
"freerdp2-debian.diff" to show the changes compared to said testing
version. (The git repo is at: [10], branch "debian/bookworm-WIP-tobi"

[10] https://salsa.debian.org/lts-team/packages/freerdp2

Compared to upstream 2.11.7, there are some additional patches
in the Debian package to fix some FTBFS to to type mismatches.
They could theoretically be dropped, but do not do harm either.


Testing

I've tested the package against a Windows 10 VM, both as RDP client and
server, using gnome's RDP facility, also testing with remmina and
vinagre and the testing I've done so far did not show any regressions.



Cheers,
tobi