Please remove python-oauth2 package from Ubuntu repo

[Jörg Frings-Fürst]

Hello,

please remove the package python-oauth2 from the repositories.

The package has two open CVEs [1][2][3]. Upstream is not longer active.

CU
Jörg

[1] https://bugs.launchpad.net/ubuntu/+source/python-oauth2/+bug/1384815
[2] https://bugs.launchpad.net/bugs/cve/2013-4346
[3] https://bugs.launchpad.net/bugs/cve/2013-4347

[Marc Deslauriers (mdeslaur)]

This package is merged/synced with Debian. Please file a bug with Debian to get it removed there first. Thanks.

[Jörg Frings-Fürst (jff-de)]

Hi Marc

I have attached the Debian RM bug.

CU
Jörg

[Jörg Frings-Fürst (jff-de)]

Hi Marc,

at debian python-oauth2 is removed from unstable and testing.

CU
Jörg

[Steve Beattie (sbeattie)]

Thanks for getting it taken care of in debian, subscribing archive admins to get it removed for vivid.

[Steve Beattie (sbeattie)]

So python-oauth2 has some reverse dependencies:

python-oauth2
Reverse Depends:
  turses
  screenlets-pack-all
  python-django-social-auth
  python-django-oauth-plus

turses was removed from debian in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779448
python-django-social-auth was removed from debian in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779447
python-django-oauth-plus was removed from debian in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779446

screenlets-pack-all (srcpkg indiv-screenlets) is an odd duck; it's a separated out package from the screenlets src package and is newer than the debian version of screenlets (which does not recommend python-auth2). The screenlets upstream is dead, having been deprecated by gnome (http://screenlets.org no longer shows anything).

Looking at the indiv-screenlets source, the only Screenlet that makes use of python-oauth2 is the Twitter screenlet. So either we should just drop the screenlets and indiv-screenlets packages entirely, or disable the Twitter screenlet from the indiv-screenlets package so that the dependency on python-oauth2 can be dropped.

[Steve Beattie (sbeattie)]

When considering what action to take with respect to indiv-screenlets, please note that that the indiv-screenlets package has 83 open bugs and the screenlets package has 113 open.

[Bryan Quigley (bryanquigley)]

Everything except for screenlets-pack-all has been removed from Wily (as synced from Debian unstable). screenlets-pack-all only had a recommends on python-oauth2. Is there another reason to remove it?

[Bryan Quigley (bryanquigley)]

Reviews on screenlets indicate this is still useful to someone in 2014. (3 Stars), closing that task as it's not blocking anything.