[gentoo-user] GLSA management

[gentoo-user] GLSA management

[Grant]

I've been checking this daily for a while:

http://www.gentoo.org/security/en/glsa/index.xml

but every time there's a vulnerability in a package I know I have
installed, my installed version is unaffected.  If I emerge world
daily, do I need to check on GLSA's?

- Grant

Re: [gentoo-user] GLSA management

[Michael Orlitzky]

On 03/06/12 13:32, Grant wrote:
> I've been checking this daily for a while:
> 
> http://www.gentoo.org/security/en/glsa/index.xml
> 
> but every time there's a vulnerability in a package I know I have
> installed, my installed version is unaffected.  If I emerge world
> daily, do I need to check on GLSA's?
> 

Does glsa-check still work? It's part of gentoolkit.

Re: [gentoo-user] GLSA management

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

On Tue, 6 Mar 2012 10:32:35 -0800, Grant wrote:

> I've been checking this daily for a while:
> 
> http://www.gentoo.org/security/en/glsa/index.xml
> 
> but every time there's a vulnerability in a package I know I have
> installed, my installed version is unaffected.  If I emerge world
> daily, do I need to check on GLSA's?

If you run testing, you usually have the fixed version before it gets
into a GLSA. Just run glsa-check -t all after syncing.


-- 
Neil Bothwick

COBOL: Completely Obsolete Business Oriented Language

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] GLSA management

[Grant]

>> I've been checking this daily for a while:
>>
>> http://www.gentoo.org/security/en/glsa/index.xml
>>
>> but every time there's a vulnerability in a package I know I have
>> installed, my installed version is unaffected.  If I emerge world
>> daily, do I need to check on GLSA's?
>
> If you run testing, you usually have the fixed version before it gets
> into a GLSA. Just run glsa-check -t all after syncing.

Thanks, that works great.

- Grant

[gentoo-user] Re: GLSA management

[»Q«]

On Tue, 6 Mar 2012 19:06:46 +0000
Neil Bothwick <neil@digimed.co.uk> wrote:

> If you run testing, you usually have the fixed version before it gets
> into a GLSA.

IME, the same is true of running stable.

I saw comments somewhere recently about the GLSA-releasing process
having a bottleneck somewhere, but there weren't details.  I think I
was reading bugs.gentoo.org, but I'm not sure.

The stabilization bug[1] for GLSA 201203-12[2] has the fix stabilized on
all arches, and a GLSA request made, on 16 January but the GLSA wasn't
issued until 6 March.  I don't know if that's an anomaly or not.

There's a lot I don't know in this post, heh.  I guess I'm requesting
comments.

1  https://bugs.gentoo.org/show_bug.cgi?id=397695 

2  http://www.gentoo.org/security/en/glsa/glsa-201203-12.xml

[gentoo-user] Re: GLSA management

[»Q«]

On Tue, 6 Mar 2012 19:48:43 -0600
»Q« <boxcars@gmx.net> wrote:

> The stabilization bug[1] for GLSA 201203-12[2] has the fix stabilized
> on all arches, and a GLSA request made, on 16 January but the GLSA
> wasn't issued until 6 March.  I don't know if that's an anomaly or
> not.

Of the 12 GLSAs issued today, I believe that was the "oldest".
 
> There's a lot I don't know in this post, heh.  I guess I'm requesting
> comments.
> 
> 1  https://bugs.gentoo.org/show_bug.cgi?id=397695 
> 
> 2  http://www.gentoo.org/security/en/glsa/glsa-201203-12.xml

Re: [gentoo-user] GLSA management

[Florian Philipp]

[-- Attachment #1: Type: text/plain, Size: 527 bytes --]

Am 06.03.2012 19:32, schrieb Grant:
> I've been checking this daily for a while:
> 
> http://www.gentoo.org/security/en/glsa/index.xml
> 
> but every time there's a vulnerability in a package I know I have
> installed, my installed version is unaffected.  If I emerge world
> daily, do I need to check on GLSA's?
> 
> - Grant
> 

I don't know the exact policy but I've never seen a GLSA being issued
before the fix got stabilized. If you update daily, GLSAs should not
affect you.

Regards,
Florian Philipp


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: [gentoo-user] GLSA management

[Grant]

>> I've been checking this daily for a while:
>>
>> http://www.gentoo.org/security/en/glsa/index.xml
>>
>> but every time there's a vulnerability in a package I know I have
>> installed, my installed version is unaffected.  If I emerge world
>> daily, do I need to check on GLSA's?
>>
>> - Grant
>>
>
> I don't know the exact policy but I've never seen a GLSA being issued
> before the fix got stabilized. If you update daily, GLSAs should not
> affect you.

Thanks Florian.

- Grant

Re: [gentoo-user] GLSA management

[Urs Schutz]

On Tue, 6 Mar 2012 10:32:35 -0800
Grant <emailgrant@gmail.com> wrote:

> I've been checking this daily for a while:
> 
> http://www.gentoo.org/security/en/glsa/index.xml
> 
> but every time there's a vulnerability in a package I
> know I have installed, my installed version is
> unaffected.  If I emerge world daily, do I need to check
> on GLSA's?
> 
> - Grant
> 

I run a cron job that does glsa-check -t all daily, and had
one glsa showing up lately (201201-09). This was an old
slot of media-libs/freetype, pulled in by emerge because of
obscure useflags in luatex. This was with stable packages.
Another one showed up because of app-text/acroread, and
was resolved by replacing acroread with evince.

So in my opinion it is necessary to run glsa-check
regularly to show the detected problems within the system.
Run as a cron job there is little work to do, checking the
mail takes less than 10 seconds.

And: A big thanks to the people who invest their time and
use their brains to write the Gentoo Linux Security Advices!

Urs