[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: concerns about the security reliability of python-gnupg

On 2019-02-07 at 11:44:45 -0500, Antoine Beaupré wrote:
> Hi,
> Recently, python-gnupg was triaged for maintenance in Debian LTS, which
> brought my attention to this little wrapper around GnuPG that I'm
> somewhat familiar with.
> Debian is marked as "vulnerable" for CVE-2019-6690 in Jessie and Stretch
> right now, with buster and sid marked as fixed, as you can see here:
> https://security-tracker.debian.org/tracker/source-package/python-gnupg

sorry, my fault for missing the CVE when uploading the new upstream
version; I will prepare the fix for stable(-security) ASAP.

I don't care enough about LTS to learn its upload procedures, but if
somebody is interested in doing it I can backport the patch and push it
to git, for them to upload.

> I'm concerned about the security of this project in general. Even though
> that specific instance might be fixed, there are many more bad security
> practices used in this project. A fork was created by Isis Agora
> Lovecruft to fix those issues:
> https://github.com/isislovecruft/python-gnupg/

AFAIK that fork is dead upstream, and it's not compatible with Vinay
Sajip's version, so it can't be used to satisfy the dependency in other

> [...]
> I suspect many such issues could be identified formally in the
> python-gnupg package.

My experience with upstream is that they are quite good at reacting to
issues that are raised on their bugtracker (and I'm happy to forward
them there from the debian BTS).

On the other hand, they don't maintain a LTS version, so the fix will
happen in the latest release, and while I'm confident that many patches
will be backportable there is no guarantee that *all* of them would be,
especially to the version in oldstable.

> But maybe, instead, we should just mark it as unsupported in
> debian-security-support and move on. There are few packages depending on
> it, in jessie:
> [...]
> in buster:
> [...]

I think this list is missing something, maybe the reverse dependencies
of python3-gnupg: I know that gajim-pgp depends on it (and is in turn
recommended by gajim) at least in buster; earlier versions used an old
embedded copy of the same library, so this isn't really a "new"

Elena ``of Valhalla''

Attachment: signature.asc
Description: PGP signature

Reply to: