[SRU] CVE-2013-1853: Almanah doesn't encrypt the database

[Angel Abad]

GApplication doesn't use "quit_mainloop" event since GIO 2.32[1], so Almanah
doesn't encrypt the database[2] when the user close the application.
This a security problem for users.

[Test Case]
Open almanah, configure encryption, save some entries, and see file ~/.local/share/diary.db

[Regression Potential]
I think there is no option for regression, this patch is from upstream and specific for this problem.

Regards,

[Angel Abad (angelabad)]

This bug was fixed in the package almanah - 0.10.1-1

---------------
almanah (0.10.1-1) experimental; urgency=high

  * Imported Upstream version 0.10.1 (Closes: #702905)

 -- Angel Abad <email address hidden> Tue, 12 Mar 2013 21:21:29 +0100

[Angel Abad (angelabad)]

Package upload to quantal-proposed.

Cheers

[Brian Murray (brian-murray)]

There was some discussion about this upload on #ubuntu-devel today:

13:50 < mdeslaur> bdmurray: it really should be built as a
                  security update
13:50 < mdeslaur> bdmurray: is it already in -proposed?
13:50 < bdmurray> mdeslaur: no its in the unapproved queue for Q
13:51 < mdeslaur> bdmurray: can you reject it, and we'll do it
                  as a security update?
13:51 < bdmurray> mdeslaur: sure will do
13:51 < mdeslaur> bdmurray: thanks
13:51 < bdmurray> mdeslaur: done

[Marc Deslauriers (mdeslaur)]

ACK on the quantal debdiff. This is currently building as a security update and will be released later today.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package almanah - 0.9.0-1ubuntu2.1

---------------
almanah (0.9.0-1ubuntu2.1) quantal-security; urgency=low

  * debian/patches/encrypt_database.patch: (LP: #1155000)
    - upstream patch to ensure encrypt the diary database.
    - CVE-2013-1853
 -- Angel Abad <email address hidden> Thu, 14 Mar 2013 21:17:12 +0100

[Angel Abad (angelabad)]

Hi, thanks for your work.

Cheers,