Ubuntu
blueman package

Comment 4 for bug 1897287

Revision history for this message

cschramm (cschramm) wrote on 2020-10-01:

2.1.patch Edit (4.3 KiB, text/plain)

Upstream and Debian maintainer here. It looks like my email to the Debian security team and this bug neither ended up here nor did anybody from Debian respond yet, so here's the part after explaining what's already documented here:

> In theory, the effect should be rather limited as blueman 2.0.6+ requires Polkit-1 authorization that should be bound to groups like wheel, sudo, or netdev, so possible attackers would more or less have the privileges already (still, users in netdev but not in sudo would gain some privileges, depending on the DHCP client software on the system).
>
> However, (apart from the fact that stretch, xenial, and bionic have older versions) this uncovered a grave packaging bug. The blueman package recommends policykit-1 but blueman does not have such "runtime-optional" Polkit-1 support and as libpolkit-agent-1-dev is not a build dependency Polkit-1 support is always disabled 🤦‍♂️.
>
> We have a private fix for the interface available in https://github.com/blueman-project/blueman/security/advisories/GHSA-jpc9-mgw6-2xwx for 2-1-stable (attached as 2.1.patch; seems to apply fine to all 2.1 versions), master, and backported to 2.0.8 (attached as 2.0.patch; seems to apply nicely to all 2.0 versions).
>
> I propose:
>
> stretch 2.0.4, xenial 2.0.4, bionic 2.0.5, buster 2.0.8: Apply 2.0.patch
> focal 2.1.2: Apply 2.1.patch

> buster 2.0.8 focal 2.1.2: Add libpolkit-agent-1-dev as a build dependency and make policykit-1 a mandatory runtime dependency
>
> bullseye 2.1.3 groovy 2.1.3: I will prepare 2.1.4 with both fixes and would let my sponsor Nobuhiro (CC) upload it to unstable as usual but that will probably reach users only after the security advisory got disclosed or would you prefer a security release for bullseye as well instead?
>
> I think it makes sense to await coordinated security releases for Debian and Ubuntu before we'll apply the fixes upstream, release 2.1.4, and disclose the security advisory. Most other distributions should be good as nobody fucked up Polkit-1 support like I did for the Debian package. 🙈

> In theory, the effect should be rather limited as blueman 2.0.6+ requires Polkit-1 authorization that should be bound to groups like wheel, sudo, or netdev, so possible attackers would more or less have the privileges already (still, users in netdev but not in sudo would gain some privileges, depending on the DHCP client software on the system).
> 
> However, (apart from the fact that stretch, xenial, and bionic have older versions) this uncovered a grave packaging bug. The blueman package recommends policykit-1 but blueman does not have such "runtime-optional" Polkit-1 support and as libpolkit-agent-1-dev is not a build dependency Polkit-1 support is always disabled 🤦‍♂️.
> 
> We have a private fix for the interface available in https://github.com/blueman-project/blueman/security/advisories/GHSA-jpc9-mgw6-2xwx for 2-1-stable (attached as 2.1.patch; seems to apply fine to all 2.1 versions), master, and backported to 2.0.8 (attached as 2.0.patch; seems to apply nicely to all 2.0 versions).
> 
> I propose:
> 
> stretch 2.0.4, xenial 2.0.4, bionic 2.0.5, buster 2.0.8: Apply 2.0.patch
> focal 2.1.2: Apply 2.1.patch

> buster 2.0.8 focal 2.1.2: Add libpolkit-agent-1-dev as a build dependency and make policykit-1 a mandatory runtime dependency
>
> bullseye 2.1.3 groovy 2.1.3: I will prepare 2.1.4 with both fixes and would let my sponsor Nobuhiro (CC) upload it to unstable as usual but that will probably reach users only after the security advisory got disclosed or would you prefer a security release for bullseye as well instead?
> 
> I think it makes sense to await coordinated security releases for Debian and Ubuntu before we'll apply the fixes upstream, release 2.1.4, and disclose the security advisory. Most other distributions should be good as nobody fucked up Polkit-1 support like I did for the Debian package. 🙈

Ubuntublueman package

Comment 4 for bug 1897287

Ubuntu
blueman package