Please backprt sks 1.1.5-1ubuntu2 release, from Ubuntu 14.10 to 14.04 LTS

Bug #1435397 reported by hgre
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
trusty-backports
Won't Fix
Wishlist
Unassigned

Bug Description

Binary package hint: sks

Since sks servers running versions < 1.15 will not be included within sks.keyserver pool

attached is the changelog between 1.1.4 to 1.1.5 from https://bitbucket.org/skskeyserver/sks-keyserver/src/40280f59d0f503da1326972757168aa42335573f/CHANGELOG?at=default

Maybe it is also kind of security related due to CVE-2014-3207

Thanx in advance

1.1.5
  - Fixes for machine-readable indices. Key expiration times are now read
    from self-signatures on the key's UIDs. In addition, instead of 8-digit
    key IDs, index entries now return the most specific key ID possible:
    16-digit key ID for V3 keys, and the full fingerprint for V4 keys.
  - Add metadata information (number of keys, number of files,
    checksums, etc) to key dump. This allows for information on the
    key dump ahead of download/import, and direct verification of checksums
    using md5sum -c <metadata-file>.
  - Replaced occurrances of the deprecated operator 'or' with '||' (BB issue #2)
  - Upgraded to cryptlib-1.7 and own changes are now packaged as separate
    patches that is installed during 'make'. Added the SHA-3 algorithm, Keccak
  - Option max_matches was setting max_internal_matches. Fixed (BB issue #4)
  - op=hget now supports option=mr for completeness (BB issue #17)
  - Add CORS header to web server responses. Allows JavaScript code to
    interact with keyservers, for example the OpenPGP.js project.
  - Change the default hkp_address and recon_address to making the
    default configuration support IPv6. (Requires OCaml 3.11.0 or newer)
  - Only use '-warn-error A' if the source is marked as development as per
    the version suffix (+) (part of BB Issue #2)
  - Reduce logging verbosity for debug level lower than 6 for (i) bad requests,
    and (ii) no results found (removal of HTTP headers in log) (BB Issue #13)
  - Add additional OIDs for ECC RFC6637 style implementations
    (brainpool and secp256k1) (BB Issue #25) and fix issue for 32 bit arches.
  - Fix a non-persistent cross-site scripting possibility resulting from
    improper input sanitation before writing to client. (BB Issue #26 | CVE-2014-3207)

Testing:
========
Mark off items in the checklist [X] as you test them, but please leave the checklist so that backporters can quickly evaluate the state of testing.

You can test-build the backport in your PPA with backportpackage:
$ backportpackage -u ppa:<lp username>/<ppa name> -s utopic -d trusty sks

* trusty:
[*] Package builds without modification
[*] sks installs cleanly and runs

Sorry for the late reply both works fine.

CVE References

hgre (hendrik-grewe)
information type: Private Security → Public
hgre (hendrik-grewe)
information type: Public → Public Security
Micah Gersten (micahg)
description: updated
Revision history for this message
Micah Gersten (micahg) wrote :

Thank you for filing this request. Could you please test (or have you built and ran) this backport on 14.04? I uploaded a backport to my PPA (ppa:micahg/ppa). Alternatively, you can backport the package yourself with the instructions I added to the description.

Changed in trusty-backports:
status: New → Incomplete
hgre (hendrik-grewe)
description: updated
Micah Gersten (micahg)
Changed in trusty-backports:
status: Incomplete → Confirmed
importance: Undecided → Wishlist
Dan Streetman (ddstreet)
Changed in trusty-backports:
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.