diff options
author | Tobias Geerinckx-Rice <me@tobias.gr> | 2018-01-11 00:54:22 +0100 |
---|---|---|
committer | Tobias Geerinckx-Rice <me@tobias.gr> | 2018-01-11 03:16:00 +0100 |
commit | f26fa354f1d76ce9cbc43cc553637af3f0c34cc2 (patch) | |
tree | 93867d59576eaa63fa9ffa1eb71eb8d820a1487e /gnu/packages/patches/newsbeuter-CVE-2017-12904.patch | |
parent | e21888dd0d0abfb6fa89a2d5b4689e36db238391 (diff) |
gnu: newsbeuter: Deprecate in favour of newsboat.
* gnu/packages/syndication.scm (newsbeuter): Redefine using
‘deprecated-package’.
* gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: Delete file.
* gnu/packages/patches/newsbeuter-CVE-2017-14500.patch: Likewise.
* gnu/local.mk (dist_patch_DATA): Remove both.
Diffstat (limited to 'gnu/packages/patches/newsbeuter-CVE-2017-12904.patch')
-rw-r--r-- | gnu/packages/patches/newsbeuter-CVE-2017-12904.patch | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch deleted file mode 100644 index 8e90502469..0000000000 --- a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch +++ /dev/null @@ -1,34 +0,0 @@ -Fix CVE-2017-12904: - -https://github.com/akrennmair/newsbeuter/issues/591 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904 - -Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1. - -Adapted from upstream source repository: - -https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 - -Description: Fix a RCE vulnerability in the bookmark command - Newsbeuter didn't properly escape the title and description fields before - passing them to the bookmarking program which could lead to remote code - execution using the shells command substitution functionality (e.g. "$()", ``, - etc) - -Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 -Last-Update: 2017-08-18 - ---- newsbeuter-2.9.orig/src/controller.cpp -+++ newsbeuter-2.9/src/controller.cpp -@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s - std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd"); - bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive"); - if (bookmark_cmd.length() > 0) { -- std::string cmdline = utils::strprintf("%s '%s' %s %s", -+ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'", - bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(), -- stfl::quote(title).c_str(), stfl::quote(description).c_str()); -+ utils::replace_all(title,"'", "%27").c_str(), -+ utils::replace_all(description,"'", "%27").c_str()); - - LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str()); |