[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170124134604.0b4e5ba1@pc1>
Date: Tue, 24 Jan 2017 13:46:04 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss security list <oss-security@...ts.openwall.com>
Subject: Windows ports of Linux software bundling outdated libraries (Gajim
/ PyCurl)
Hi,
I feel I've opened a can of worms here.
In a comment on the news site heise a reader pointed out that Gajim for
windows ships very old versions of OpenSSL and Python [1].
I decided to have a look and gajim indeed bundled files SSLEAY32.dll
and LIBEAY32.dll that came from OpenSSL 0.9.8l. However it seems that
was the least of the problems, as these are probably just some leftover
and not used by anything.
However, as it turns out gajim ships several copies of old versions of
OpenSSL (bug report here [2]).
The source of those is actually that gajim itself uses other projects,
mentioned in the bug report are gtk+, pycurl and cryptodome.
I verified that for pycurl, which provides a windows installer that
bundles the curl and openssl version at the time of the last release,
which was in June 2015.
Note that it seems pycurl matches the version numbers of curl, however
the latest release is 7.43.0. On linux systems it'll use whatever curl
is on the system, which can be newer, so everything's fine, but the
windows installer bundles the matching 7.43.0 curl version, which is
quite old. Notably it was long before the recent audit of curl, which
uncovered a large number of security vulnerabilities.
I reported this to pycurl as well [3].
The moral of the story is probably that if you recommend windows ports
of your favorite linux desktop application to your windows using
friends you may want to check if they bundle some really outdated
stuff. I encourage everyone to watch out for similar issues and report
them to the affected projects.
[1]
https://www.heise.de/forum/heise-Security/News-Kommentare/XMPP-Jabber-Krypto-Messenger-ChatSecure-verschluesselt-mit-OMEMO-Protokoll/Gajim-Release-enthaelt-uralte-Versionen-von-Python-OpenSSL/posting-29818036/show/
[2] https://dev.gajim.org/gajim/gajim/issues/8513
[3] https://github.com/pycurl/pycurl/issues/437
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
