| Summary: | WebKitGTK+ Security Advisories | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Armin Kuster <akuster> |
| Component: | core | Assignee: | ytao <yue.tao> |
| Status: | RESOLVED WONTFIX | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium+ | CC: | akuster, alex.kanavin, joshuagloe, meta.mr.watcher, meta.watcher, randy.macleod, yue.tao |
| Version: | 2.0.1 | ||
| Target Milestone: | 2.0.2 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
|
Description
Armin Kuster
2016-01-06 00:05:53 UTC
Randy, I can help score these as I need to do this any ways for our doc purposes. I added Yue Tao to this bug. Copying from an WR email: > Yue Tao replied: >> Randy MacLeod wrote: >> There are ** 134 ** CVEs open for webgitgtk+. >> These most likely affect LIN8 since it's based on jethro. >> When will you be able to determine if we can >> cost-effectively cherry-pick fixes back to jethro? >> If that's too expensive, perhaps we could uprev >> from webgitgtk+_2.8.5 to webgitgtk+_2.8.6 > > Fixing them by patches is requested by sustaining policy, but for some > issues, I think uprev is more reasonable, like this one. Some of them > impact the version up to 3.10, so if we decide to upgrade it, 2.8.6 is > not enough. Moreover, 2.8.6 is not released yet, so I am not sure all > the CVEs can be fixed in 2.8.6. On the other hand, it might give us a chance to ensure that the CVEs that we care about do get fixed on 2.8.6... > The risk to uprev 2.10.5 is the version gap is a little big. Yeah, I don't think 2.10.5 would be reasonable for jethro. > Do you know who is familiar to webkitgtk? I think > it's better the expert to take a look it. I don't know of anyone in WR with much webgitgtk+ knowledge but the git log shows: yocto/oe-core.git $ git log -44 meta/recipes-sato/webkit | grep Author: | sort | uniq -c | sort -nr | head -2 9 Author: Ross Burton <ross.burton@intel.com> 5 Author: Martin Jansa <martin.jansa@gmail.com> So, I think the next step is to split this long defect list up, and make a table of CVE, Fix needed for 2.8.5, 2.8.6 then we can decide if we upgrade or not. It seems like we might be able to split up the work between Yue Tao and Armin Kuster so at some point, we should create additional YP defects so we make that division of work clear. Following CVE have been fixed by 2.8.5, 2.8.6 CVE-2015-1122, CVE-2015-1152, CVE-2015-1155, CVE-2015-3660, CVE-2015-3730, CVE-2015-3738, CVE-2015-3740, CVE-2015-3742, CVE-2015-3744, CVE-2015-3746, CVE-2015-3750, CVE-2015-3751, CVE-2015-3754, CVE-2015-3755, CVE-2015-5804, CVE-2015-5805, CVE-2015-5807, CVE-2015-5810, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5817, CVE-2015-5825, CVE-2015-5827, CVE-2015-5828, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104 Please read this, it's a bit long, but worth it: https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/ Summary: the upstream will not backport CVE fixes, and they will not be making point releases in old branches with any kind of lifecycle guarantee. Providing ongoing updates to the latest stable release of webkit is the only way to stay secure. So I believe that you indeed have to update webkit to 2.10.7, or whatever is the latest stable release, and keep doing this for as long as a yocto release needs to be supported. There's no 2.8.x release for webkitgtk+ that will fix the large list of CVE's in WSA-2015-0002 and we don't have the expertise, or the man power, to backport all of the fixes across an API incompatible version of an extremely complex project. Therefore we unfortunately have to close this issue as WONTFIX. |