Ubuntu AppArmor policy is too lenient with shell scripts

[Jamie Strandboge]

Dan Rosenberg has blogged about some AppArmor profile weaknesses in Ubuntu:
http://blog.azimuthsecurity.com/2012/09/poking-holes-in-apparmor-profiles.html

This bug will track the work needed to fix them. This is a continuation of bug #851986, except for PATH and shell scripts. Unfortunately, until we have proper environment filtering support in AppArmor, we will have to employ more bandaids-- specifically, either eliminating Ux/sanitized helper on shell scripts or adjusting those shell scripts to explicitly set their PATH. The good news is that environment filtering is on the AppArmor roadmap, and it something we will be targeting in the future releases. I filed bug #1045985 to more easily track the progress of that work.

[Jamie Strandboge (jdstrand)]

For apport, either the '/usr/bin/apport-bug Cx -> sanitized_helper,' rule needs to be removed or we explicitly set PATH in /usr/bin/apport-bug.

[Jamie Strandboge (jdstrand)]

For isc-dhcp and dhcp3 we should adjust /sbin/dhclient-script to explicitly set the PATH. It is possible to confine it, but with everything that can be put in /etc/dhcp/dhclient-*-hooks.d, this is regression prone.

[Jamie Strandboge (jdstrand)]

For apparmor, the chromium-browser profile in the apparmor-profiles package will need to be adjusted to either confine xdg-settings or adjust it to explicitly set PATH.

[Jamie Strandboge (jdstrand)]

For chromium-browser, we probably want to disable '-d'. An alternative would be to conditionally disable it only when the process is confined. This is brittle and likely want provide the protection we want.

[Jamie Strandboge (jdstrand)]

For firefox, we probably want to disable '-d'. An alternative would be to conditionally disable it only when the process is confined. This is brittle and likely want provide the protection we want. We will want to explicitly set the PATH in its scripts.

[Jamie Strandboge (jdstrand)]

Also for chromium-browser, we will want to explicitly set the PATH in its scripts.

[Jamie Strandboge (jdstrand)]

CUPS is very difficult. We can certainly adjust the filters that are available in Ubuntu to explicitly set the PATH, but since 3rd party filters can be installed, this gets more and more challenging. Like bug #851986, this may not be reasonably solvable for CUPS until we have proper environment filtering support in AppArmor.

[Till Kamppeter (till-kamppeter)]

pitti, any idea how to improve the situation with CUPS?

[Jamie Strandboge (jdstrand)]

An updated apport is in quantal-proposed.

[Jamie Strandboge (jdstrand)]

isc-dhcp uploaded to quantal-proposed.

[Jamie Strandboge (jdstrand)]

I need to respin isc-dhcp on quantal since 4.2.4-1ubuntu6 was already there.

[Jamie Strandboge (jdstrand)]

Ok, both apport and isc-dhcp needed to be respun. Both are uploaded and sitting in unapproved.

[Martin Pitt (pitti)]

Thanks Jamie; do you have a pointer to the apport patch, or can attach it here? I'd like to apply it to trunk as well (or make it suitable for that).

[Jamie Strandboge (jdstrand)]

isc-dhcp and dhcp3 have been uploaded to the security PPA.

[Jamie Strandboge (jdstrand)]

While the ubuntu-integration abstraction doesn't exist in 10.04 LTS, the firefox profile has a Ux rule for apport-bug.

[Jamie Strandboge (jdstrand)]

apport has been uploaded to the security PPA.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.5.1-0ubuntu7

---------------
apport (2.5.1-0ubuntu7) quantal-proposed; urgency=low

  * bin/apport-bug: Explicitly set the PATH to that of ENV_SUPATH in
    /etc/login.defs and unset ENV and CDPATH. We need do this so that confined
    applications using ubuntu-browsers.d/ubuntu-integration cannot abuse the
    environment to escape AppArmor confinement via this script (LP: #1045986).
    This can be removed once AppArmor supports environment filtering
    (LP: 1045985)

apport (2.5.1-0ubuntu6) quantal; urgency=low

  * data/general/ubuntu.py: handle the case where a log file is compressed
    when reviewing package installation failures (LP: #917903)

apport (2.5.1-0ubuntu5) quantal; urgency=low

  * Use Python string rather than QString, LP: #1028984
 -- Jamie Strandboge <email address hidden> Wed, 05 Sep 2012 08:38:23 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.2.4-1ubuntu7

---------------
isc-dhcp (4.2.4-1ubuntu7) quantal-proposed; urgency=low

  * debian/dhclient-script.linux: Explicitly set the PATH to that of
    ENV_SUPATH in /etc/login.defs and unset various other variables. We need
    to do this so /sbin/dhclient cannot abuse the environment to escape
    AppArmor confinement via this script. This can be removed once AppArmor
    supports environment filtering (LP: 1045985). Don't worry about
    debian/dhclient-script.linux.udeb or debian/dhclient-script.kfreebsd*
    since AppArmor isn't used in these environments.
    - LP: #1045986

isc-dhcp (4.2.4-1ubuntu6) quantal-proposed; urgency=low

  * SECURITY UPDATE: denial of service via unexpected client identifiers
    - debian/patches/CVE-2012-3570.patch: validate MAC length in
      includes/dhcpd.h, server/dhcpv6.c.
    - CVE-2012-3570
  * SECURITY UPDATE: denial of service via malformed client identifiers
    - debian/patches/CVE-2012-3571.patch: validate packets in
      common/options.c, includes/dhcpd.h.
    - CVE-2012-3571
  * SECURITY UPDATE: denial of service via memory leaks
    - debian/patches/CVE-2012-3954.patch: properly manage memory in
      common/options.c and server/dhcpv6.c.
    - CVE-2012-3954
 -- Jamie Strandboge <email address hidden> Wed, 05 Sep 2012 08:59:49 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.8.0-0ubuntu3

---------------
apparmor (2.8.0-0ubuntu3) quantal; urgency=low

  * remove 0010-lp972367.patch and 0012-lp964510.patch which should have been
    dropped in 2.8.0-0ubuntu1 since they are included upstream
  * debian/patches/0001-add-chromium-browser.patch:
    - add a couple of small accesses
    - add a child profile for xdgsettings (LP: #1045986)
 -- Jamie Strandboge <email address hidden> Mon, 17 Sep 2012 08:26:46 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.1.1-P1-17ubuntu10.5

---------------
isc-dhcp (4.1.1-P1-17ubuntu10.5) oneiric-security; urgency=low

  [ Jamie Strandboge ]
  * debian/dhclient-script.linux: Explicitly set the PATH to that of
    ENV_SUPATH in /etc/login.defs and unset various other variables. We need
    to do this so /sbin/dhclient cannot abuse the environment to escape
    AppArmor confinement via this script. Don't worry about
    debian/dhclient-script.linux.udeb or debian/dhclient-script.kfreebsd*
    since AppArmor isn't used in these environments.
    - LP: #1045986

  [ Marc Deslauriers ]
  * SECURITY UPDATE: denial of service via ipv6 lease expiration time
    reduction
    - debian/patches/CVE-2012-3955.patch: properly handle time reduction in
      server/dhcpv6.c, server/mdb6.c.
    - CVE-2012-3955
 -- Marc Deslauriers <email address hidden> Fri, 14 Sep 2012 13:02:05 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.1.ESV-R4-0ubuntu5.5

---------------
isc-dhcp (4.1.ESV-R4-0ubuntu5.5) precise-security; urgency=low

  [ Jamie Strandboge ]
  * debian/dhclient-script.linux: Explicitly set the PATH to that of
    ENV_SUPATH in /etc/login.defs and unset various other variables. We need
    to do this so /sbin/dhclient cannot abuse the environment to escape
    AppArmor confinement via this script. Don't worry about
    debian/dhclient-script.linux.udeb or debian/dhclient-script.kfreebsd*
    since AppArmor isn't used in these environments.
    - LP: #1045986

  [ Marc Deslauriers ]
  * SECURITY UPDATE: denial of service via ipv6 lease expiration time
    reduction
    - debian/patches/CVE-2012-3955.patch: properly handle time reduction in
      server/dhcpv6.c, server/mdb6.c.
    - CVE-2012-3955
 -- Marc Deslauriers <email address hidden> Fri, 14 Sep 2012 12:58:33 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.1.1-P1-15ubuntu9.6

---------------
isc-dhcp (4.1.1-P1-15ubuntu9.6) natty-security; urgency=low

  [ Jamie Strandboge ]
  * debian/dhclient-script.linux: Explicitly set the PATH to that of
    ENV_SUPATH in /etc/login.defs and unset various other variables. We need
    to do this so /sbin/dhclient cannot abuse the environment to escape
    AppArmor confinement via this script. Don't worry about
    debian/dhclient-script.linux.udeb or debian/dhclient-script.kfreebsd*
    since AppArmor isn't used in these environments.
    - LP: #1045986

  [ Marc Deslauriers ]
  * SECURITY UPDATE: denial of service via ipv6 lease expiration time
    reduction
    - debian/patches/CVE-2012-3955.patch: properly handle time reduction in
      server/dhcpv6.c, server/mdb6.c.
    - CVE-2012-3955
 -- Marc Deslauriers <email address hidden> Fri, 14 Sep 2012 13:04:46 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package dhcp3 - 3.1.3-2ubuntu3.4

---------------
dhcp3 (3.1.3-2ubuntu3.4) lucid-security; urgency=low

  * debian/dhclient-script.linux: Explicitly set the PATH to that of
    ENV_SUPATH in /etc/login.defs and unset various other variables. We need
    to do this so /sbin/dhclient cannot abuse the environment to escape
    AppArmor confinement via this script. Don't worry about
    debian/dhclient-script.udeb or debian/dhclient-script.kfreebsd since
    AppArmor isn't used in these environments.
    - LP: #1045986
  * debian/patches/adjust-configure-for-linux3.dpatch: default to linux-2.2
    for 3.0+ kernels
 -- Jamie Strandboge <email address hidden> Wed, 05 Sep 2012 10:58:55 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 1.23-0ubuntu4.1

---------------
apport (1.23-0ubuntu4.1) oneiric-security; urgency=low

  * bin/apport-bug: Explicitly set the PATH to that of ENV_SUPATH in
    /etc/login.defs and unset ENV and CDPATH. We need do this so that confined
    applications using ubuntu-browsers.d/ubuntu-integration cannot abuse the
    environment to escape AppArmor confinement via this script (LP: #1045986).
 -- Jamie Strandboge <email address hidden> Wed, 05 Sep 2012 13:41:45 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 2.0.1-0ubuntu15.1

---------------
apport (2.0.1-0ubuntu15.1) precise-security; urgency=low

  * bin/apport-bug: Explicitly set the PATH to that of ENV_SUPATH in
    /etc/login.defs and unset ENV and CDPATH. We need do this so that confined
    applications using ubuntu-browsers.d/ubuntu-integration cannot abuse the
    environment to escape AppArmor confinement via this script (LP: #1045986).
 -- Jamie Strandboge <email address hidden> Mon, 17 Dec 2012 13:33:42 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package apport - 1.13.3-0ubuntu2.2

---------------
apport (1.13.3-0ubuntu2.2) lucid-security; urgency=low

  * bin/apport-bug: Explicitly set the PATH to that of ENV_SUPATH in
    /etc/login.defs and unset ENV and CDPATH. We need do this so that confined
    applications which use apport-bug cannot abuse the environment to escape
    AppArmor confinement via this script (LP: #1045986).
 -- Jamie Strandboge <email address hidden> Wed, 05 Sep 2012 13:43:36 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.7.102-0ubuntu3.7

---------------
apparmor (2.7.102-0ubuntu3.7) precise-security; urgency=low

  * debian/patches/0001-add-chromium-browser.patch:
    - add access for newer versions of chromium (LP: #1091862)
    - add a child profile for xdgsettings (LP: #1045986)
  * debian/patches/0021-fix-racy-onexec-test.patch: fix race in onexec.sh
    kernel regression test
 -- Jamie Strandboge <email address hidden> Wed, 19 Dec 2012 07:51:38 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.7.0~beta1+bzr1774-1ubuntu2.2

---------------
apparmor (2.7.0~beta1+bzr1774-1ubuntu2.2) oneiric-security; urgency=low

  * debian/patches/0001-add-chromium-browser.patch:
    - add various accesses for newer chromium versions (LP: #1091862)
    - add a child profile for xdgsettings (LP: #1045986)
  * debian/put-all-profiles-in-complain-mode.sh: deal with existing flags
 -- Jamie Strandboge <email address hidden> Tue, 18 Dec 2012 11:53:38 -0600

[Brian Murray (brian-murray)]

Hello Jamie, or anyone else affected,

Accepted apport into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/apport/2.0.1-0ubuntu17.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Jamie Strandboge (jdstrand)]

The update for this bug was included in an update to precise-security. I tested that 2.0.1-0ubuntu17.1 contains the fix for this bug and that 2.0.1-0ubuntu17.1 passes QRT. Marking 'verification-done'.

[Colin Watson (cjwatson)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Adolfo Jayme Barrientos (fitojb)]

(Untargetting old EOLd releases)

[Launchpad Janitor (janitor)]

This bug was fixed in the package chromium-browser - 28.0.1500.52-0ubuntu1.12.10.2

---------------
chromium-browser (28.0.1500.52-0ubuntu1.12.10.2) quantal-security; urgency=low

  [Chad MILLER]
  * New stable release 28.0.1500.52
  * New stable release 28.0.1500.45
  * New stable release 27.0.1453.110:
    - CVE-2013-2855: Memory corruption in dev tools API.
    - CVE-2013-2856: Use-after-free in input handling.
    - CVE-2013-2857: Use-after-free in image handling.
    - CVE-2013-2858: Use-after-free in HTML5 Audio.
    - CVE-2013-2859: Cross-origin namespace pollution.
    - CVE-2013-2860: Use-after-free with workers accessing database APIs.
    - CVE-2013-2861: Use-after-free with SVG.
    - CVE-2013-2862: Memory corruption in Skia GPU handling.
    - CVE-2013-2863: Memory corruption in SSL socket handling.
    - CVE-2013-2864: Bad free in PDF viewer.
  * New stable release 27.0.1453.93:
    - CVE-2013-2837: Use-after-free in SVG.
    - CVE-2013-2838: Out-of-bounds read in v8.
    - CVE-2013-2839: Bad cast in clipboard handling.
    - CVE-2013-2840: Use-after-free in media loader.
    - CVE-2013-2841: Use-after-free in Pepper resource handling.
    - CVE-2013-2842: Use-after-free in widget handling.
    - CVE-2013-2843: Use-after-free in speech handling.
    - CVE-2013-2844: Use-after-free in style resolution.
    - CVE-2013-2845: Memory safety issues in Web Audio.
    - CVE-2013-2846: Use-after-free in media loader.
    - CVE-2013-2847: Use-after-free race condition with workers.
    - CVE-2013-2848: Possible data extraction with XSS Auditor.
    - CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
  * Drop unneeded patches,
      safe-browsing-sigbus.patch
      dont-assume-cross-compile-on-arm.patch
      struct-siginfo.patch
      ld-memory-32bit.patch
      dlopen_sonamed_gl.patch
  * Temporarily disable webapps patches.
  * Update arm-neon patch, format-flag patch, search-credit patch,
    title-bar-system-default patch.
  * Make get-orig-source nicer. Package tarball contents from upstream
    correctly.
  * Reenable dyn-linking of major components of chromium for 32-bit machines.
    Fix a libdir path bug in debian/chromium-browser.sh.in .
  * No longer try to use system libraries. Generally, Security Team would
    hate bundled libraries because they provide a wide liability, but
    Chromium Project is pretty good about maintaining their bundled-source
    libraries. We can not pull cr-required lib versions forward in older
    Ubuntus, and we can't guarantee all the distro versions of libraries work
    with chromium-browser. The default security policy might be worse. Bundled
    libraries is less work overall.
  * Exclude included XDG files even if they are built.
  * Use NEON instructions on ARM, optionally. This might use run-time checks
    for hardware capability, but even if it doesn't we can add it later.
  * Clean up difference checks in debian/rules that make sure that all files
    that the build makes are used in packages, and no longer hide any, and no
    longer consider it an error if some are unused. Treat it as a warning,
    not a fatality.
  * Use legible shell instead of make-generated shell in set...

[Launchpad Janitor (janitor)]

This bug was fixed in the package chromium-browser - 28.0.1500.52-0ubuntu1.12.04.2

---------------
chromium-browser (28.0.1500.52-0ubuntu1.12.04.2) precise-security; urgency=low

  [Chad MILLER]
  * New stable release 28.0.1500.52
  * New stable release 28.0.1500.45
  * New stable release 27.0.1453.110:
    - CVE-2013-2855: Memory corruption in dev tools API.
    - CVE-2013-2856: Use-after-free in input handling.
    - CVE-2013-2857: Use-after-free in image handling.
    - CVE-2013-2858: Use-after-free in HTML5 Audio.
    - CVE-2013-2859: Cross-origin namespace pollution.
    - CVE-2013-2860: Use-after-free with workers accessing database APIs.
    - CVE-2013-2861: Use-after-free with SVG.
    - CVE-2013-2862: Memory corruption in Skia GPU handling.
    - CVE-2013-2863: Memory corruption in SSL socket handling.
    - CVE-2013-2864: Bad free in PDF viewer.
  * New stable release 27.0.1453.93:
    - CVE-2013-2837: Use-after-free in SVG.
    - CVE-2013-2838: Out-of-bounds read in v8.
    - CVE-2013-2839: Bad cast in clipboard handling.
    - CVE-2013-2840: Use-after-free in media loader.
    - CVE-2013-2841: Use-after-free in Pepper resource handling.
    - CVE-2013-2842: Use-after-free in widget handling.
    - CVE-2013-2843: Use-after-free in speech handling.
    - CVE-2013-2844: Use-after-free in style resolution.
    - CVE-2013-2845: Memory safety issues in Web Audio.
    - CVE-2013-2846: Use-after-free in media loader.
    - CVE-2013-2847: Use-after-free race condition with workers.
    - CVE-2013-2848: Possible data extraction with XSS Auditor.
    - CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
  * Drop unneeded patches,
      safe-browsing-sigbus.patch
      dont-assume-cross-compile-on-arm.patch
      struct-siginfo.patch
      ld-memory-32bit.patch
      dlopen_sonamed_gl.patch
  * Update arm-neon patch, format-flag patch, search-credit patch,
    title-bar-system-default patch.
  * Make get-orig-source nicer. Package tarball contents from upstream
    correctly.
  * Reenable dyn-linking of major components of chromium for 32-bit machines.
    Fix a libdir path bug in debian/chromium-browser.sh.in .
  * No longer try to use system libraries. Generally, Security Team would
    hate bundled libraries because they provide a wide liability, but
    Chromium Project is pretty good about maintaining their bundled-source
    libraries. We can not pull cr-required lib versions forward in older
    Ubuntus, and we can't guarantee all the distro versions of libraries work
    with chromium-browser. The default security policy might be worse. Bundled
    libraries is less work overall.
  * Exclude included XDG files even if they are built.
  * Use NEON instructions on ARM, optionally. This might use run-time checks
    for hardware capability, but even if it doesn't we can add it later.
  * Clean up difference checks in debian/rules that make sure that all files
    that the build makes are used in packages, and no longer hide any, and no
    longer consider it an error if some are unused. Treat it as a warning,
    not a fatality.
  * Use legible shell instead of make-generated shell in setting the rpath
    in rules.
  * Add new ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package chromium-browser - 28.0.1500.52-0ubuntu1.13.04.2

---------------
chromium-browser (28.0.1500.52-0ubuntu1.13.04.2) raring-security; urgency=low

  [Chad MILLER]
  * New stable release 28.0.1500.52
  * New stable release 28.0.1500.45
  * New stable release 27.0.1453.110:
    - CVE-2013-2855: Memory corruption in dev tools API.
    - CVE-2013-2856: Use-after-free in input handling.
    - CVE-2013-2857: Use-after-free in image handling.
    - CVE-2013-2858: Use-after-free in HTML5 Audio.
    - CVE-2013-2859: Cross-origin namespace pollution.
    - CVE-2013-2860: Use-after-free with workers accessing database APIs.
    - CVE-2013-2861: Use-after-free with SVG.
    - CVE-2013-2862: Memory corruption in Skia GPU handling.
    - CVE-2013-2863: Memory corruption in SSL socket handling.
    - CVE-2013-2864: Bad free in PDF viewer.
  * New stable release 27.0.1453.93:
    - CVE-2013-2837: Use-after-free in SVG.
    - CVE-2013-2838: Out-of-bounds read in v8.
    - CVE-2013-2839: Bad cast in clipboard handling.
    - CVE-2013-2840: Use-after-free in media loader.
    - CVE-2013-2841: Use-after-free in Pepper resource handling.
    - CVE-2013-2842: Use-after-free in widget handling.
    - CVE-2013-2843: Use-after-free in speech handling.
    - CVE-2013-2844: Use-after-free in style resolution.
    - CVE-2013-2845: Memory safety issues in Web Audio.
    - CVE-2013-2846: Use-after-free in media loader.
    - CVE-2013-2847: Use-after-free race condition with workers.
    - CVE-2013-2848: Possible data extraction with XSS Auditor.
    - CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
  * Drop unneeded patches,
      safe-browsing-sigbus.patch
      dont-assume-cross-compile-on-arm.patch
      struct-siginfo.patch
      ld-memory-32bit.patch
      dlopen_sonamed_gl.patch
  * Temporarily disable webapps patches.
  * Update arm-neon patch, format-flag patch, search-credit patch,
    title-bar-system-default patch.
  * Make get-orig-source nicer. Package tarball contents from upstream
    correctly.
  * Reenable dyn-linking of major components of chromium for 32-bit machines.
    Fix a libdir path bug in debian/chromium-browser.sh.in .
  * No longer try to use system libraries. Generally, Security Team would
    hate bundled libraries because they provide a wide liability, but
    Chromium Project is pretty good about maintaining their bundled-source
    libraries. We can not pull cr-required lib versions forward in older
    Ubuntus, and we can't guarantee all the distro versions of libraries work
    with chromium-browser. The default security policy might be worse. Bundled
    libraries is less work overall.
  * Exclude included XDG files even if they are built.
  * Use NEON instructions on ARM, optionally. This might use run-time checks
    for hardware capability, but even if it doesn't we can add it later.
  * Clean up difference checks in debian/rules that make sure that all files
    that the build makes are used in packages, and no longer hide any, and no
    longer consider it an error if some are unused. Treat it as a warning,
    not a fatality.
  * Use legible shell instead of make-generated shell in sett...

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release