Ubuntu
ack-grep package

Security hole in ack versions 2.00 to 2.11_02.

Bug #1263322 reported by Ma Hsiao-chun on 2013-12-21

272

This bug affects 3 people

Affects		Status	Importance	Assigned to	Milestone
	ack-grep (Debian)	Fix Released	Unknown	debbugs #731848
	ack-grep (Ubuntu)	Incomplete	Undecided	Ma Hsiao-chun

Bug Description

Please refer to upstream info page: http://beyondgrep.com/security/

I guess we should upgrade ack-grep to 2.12 in saucy.

Tags:

CVE References

2013-7069

Revision history for this message

Seth Arnold (seth-arnold) wrote on 2013-12-27:

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Changed in ack-grep (Ubuntu):
status:	New → Incomplete

Seth Arnold (seth-arnold) on 2013-12-27

information type:

Private Security → Public Security

Revision history for this message

Ma Hsiao-chun (mahsiaochun) wrote on 2013-12-27:

I don't think upstream would be bothered with this.

I created a debdiff by (using a trusty box):
pull-lp-source ack-grep
pull-lp-source ack-grep saucy
debdiff ack-grep_2.04-2.dsc ack-grep_2.12-1.dsc > ack-grep.diff

Revision history for this message

Ma Hsiao-chun (mahsiaochun) wrote on 2013-12-27:

ack-grep.diff Edit (186.6 KiB, text/plain)

Changed in ack-grep (Ubuntu):
status:	Incomplete → New

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2013-12-27:

The attachment "ack-grep.diff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags:

added: patch

Revision history for this message

Seth Arnold (seth-arnold) wrote on 2014-01-08:

Ma, thanks for preparing this patch. However, it is too invasive to use. Please reduce the patch to only include the fixes for the security issues that need to be addressed. As mentioned in our FAQ, we do not do wholesale version updates for security issues except for a very small subset of packages: https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions

In the current form, NAK.

Thanks

tags:	removed: patch
Changed in ack-grep (Ubuntu):
status:	New → Incomplete
assignee:	nobody → Ma Xiaojun (damage3025)

Bug Watch Updater (bug-watch-updater) on 2014-01-08

Changed in ack-grep (Debian):
status:	Unknown → Fix Released

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2014-01-14:

Since there is no debdiff to sponsor at the moment, I am unsubscribing ubuntu-security-sponsors. Please subscribe the group again once a debdiff has been attached. Thanks!