Please backprt sks 1.1.5-1ubuntu2 release, from Ubuntu 14.10 to 14.04 LTS

Bug #1435397 reported by hgre
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
trusty-backports
Wishlist
Unassigned

Bug Description

Binary package hint: sks

Since sks servers running versions < 1.15 will not be included within sks.keyserver pool

attached is the changelog between 1.1.4 to 1.1.5 from https://bitbucket.org/skskeyserver/sks-keyserver/src/40280f59d0f503da1326972757168aa42335573f/CHANGELOG?at=default

Maybe it is also kind of security related due to CVE-2014-3207

Thanx in advance

1.1.5
  - Fixes for machine-readable indices. Key expiration times are now read
    from self-signatures on the key's UIDs. In addition, instead of 8-digit
    key IDs, index entries now return the most specific key ID possible:
    16-digit key ID for V3 keys, and the full fingerprint for V4 keys.
  - Add metadata information (number of keys, number of files,
    checksums, etc) to key dump. This allows for information on the
    key dump ahead of download/import, and direct verification of checksums
    using md5sum -c <metadata-file>.
  - Replaced occurrances of the deprecated operator 'or' with '||' (BB issue #2)
  - Upgraded to cryptlib-1.7 and own changes are now packaged as separate
    patches that is installed during 'make'. Added the SHA-3 algorithm, Keccak
  - Option max_matches was setting max_internal_matches. Fixed (BB issue #4)
  - op=hget now supports option=mr for completeness (BB issue #17)
  - Add CORS header to web server responses. Allows JavaScript code to
    interact with keyservers, for example the OpenPGP.js project.
  - Change the default hkp_address and recon_address to making the
    default configuration support IPv6. (Requires OCaml 3.11.0 or newer)
  - Only use '-warn-error A' if the source is marked as development as per
    the version suffix (+) (part of BB Issue #2)
  - Reduce logging verbosity for debug level lower than 6 for (i) bad requests,
    and (ii) no results found (removal of HTTP headers in log) (BB Issue #13)
  - Add additional OIDs for ECC RFC6637 style implementations
    (brainpool and secp256k1) (BB Issue #25) and fix issue for 32 bit arches.
  - Fix a non-persistent cross-site scripting possibility resulting from
    improper input sanitation before writing to client. (BB Issue #26 | CVE-2014-3207)

Testing:
========
Mark off items in the checklist [X] as you test them, but please leave the checklist so that backporters can quickly evaluate the state of testing.

You can test-build the backport in your PPA with backportpackage:
$ backportpackage -u ppa:<lp username>/<ppa name> -s utopic -d trusty sks

* trusty:
[*] Package builds without modification
[*] sks installs cleanly and runs

Sorry for the late reply both works fine.

CVE References

hgre (hendrik-grewe)
information type: Private Security → Public
hgre (hendrik-grewe)
information type: Public → Public Security
Micah Gersten (micahg)
description: updated
Revision history for this message
Micah Gersten (micahg) wrote :

Thank you for filing this request. Could you please test (or have you built and ran) this backport on 14.04? I uploaded a backport to my PPA (ppa:micahg/ppa). Alternatively, you can backport the package yourself with the instructions I added to the description.

Changed in trusty-backports:
status: New → Incomplete
hgre (hendrik-grewe)
description: updated
Micah Gersten (micahg)
Changed in trusty-backports:
status: Incomplete → Confirmed
importance: Undecided → Wishlist
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers