| 2017-01-18 07:42:53 |
Jeremy Bícha |
bug |
|
|
added bug |
| 2017-01-18 07:43:10 |
Jeremy Bícha |
bug task added |
|
bubblewrap (Ubuntu) |
|
| 2017-01-18 08:17:23 |
Jeremy Bícha |
attachment added |
|
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805726/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
| 2017-01-18 08:17:50 |
Jeremy Bícha |
attachment added |
|
ostree-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805727/+files/ostree-yakkety-lp1657357.debdiff |
|
| 2017-01-18 08:18:26 |
Jeremy Bícha |
attachment added |
|
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805728/+files/flatpak-yakkety-lp1657357.debdiff |
|
| 2017-01-18 08:18:58 |
Jeremy Bícha |
cve linked |
|
2017-5226 |
|
| 2017-01-18 08:19:30 |
Jeremy Bícha |
bug |
|
|
added subscriber Ubuntu Security Sponsors Team |
| 2017-01-18 08:19:33 |
Jeremy Bícha |
information type |
Public |
Public Security |
|
| 2017-01-18 08:23:04 |
Jeremy Bícha |
attachment removed |
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805726/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
|
| 2017-01-18 08:23:29 |
Jeremy Bícha |
attachment added |
|
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805729/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
| 2017-01-18 23:08:18 |
Mathew Hodson |
bug watch added |
|
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850702 |
|
| 2017-01-18 23:08:18 |
Mathew Hodson |
bug task added |
|
bubblewrap (Debian) |
|
| 2017-01-18 23:08:31 |
Mathew Hodson |
bubblewrap (Ubuntu): importance |
Undecided |
Medium |
|
| 2017-01-18 23:13:25 |
Mathew Hodson |
flatpak (Ubuntu): importance |
Undecided |
Medium |
|
| 2017-01-18 23:43:02 |
Bug Watch Updater |
bubblewrap (Debian): status |
Unknown |
Fix Released |
|
| 2017-01-19 00:23:49 |
Jeremy Bícha |
attachment removed |
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1657357/+attachment/4805728/+files/flatpak-yakkety-lp1657357.debdiff |
|
|
| 2017-01-19 00:23:54 |
Jeremy Bícha |
attachment removed |
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1657357/+attachment/4805729/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
|
| 2017-01-19 00:24:30 |
Jeremy Bícha |
attachment added |
|
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1657357/+attachment/4806062/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
| 2017-01-19 00:24:55 |
Jeremy Bícha |
attachment added |
|
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1657357/+attachment/4806063/+files/flatpak-yakkety-lp1657357.debdiff |
|
| 2017-01-20 03:11:14 |
Jeremy Bícha |
attachment removed |
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806063/+files/flatpak-yakkety-lp1657357.debdiff |
|
|
| 2017-01-20 03:11:18 |
Jeremy Bícha |
attachment removed |
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806062/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
|
| 2017-01-20 03:11:21 |
Jeremy Bícha |
attachment removed |
ostree-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4805727/+files/ostree-yakkety-lp1657357.debdiff |
|
|
| 2017-01-20 03:11:48 |
Jeremy Bícha |
attachment added |
|
bubblewrap-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806559/+files/bubblewrap-yakkety-lp1657357.debdiff |
|
| 2017-01-20 03:12:25 |
Jeremy Bícha |
attachment added |
|
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806560/+files/flatpak-yakkety-lp1657357.debdiff |
|
| 2017-01-20 03:15:45 |
Jeremy Bícha |
attachment removed |
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806560/+files/flatpak-yakkety-lp1657357.debdiff |
|
|
| 2017-01-20 03:16:07 |
Jeremy Bícha |
attachment added |
|
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806561/+files/flatpak-yakkety-lp1657357.debdiff |
|
| 2017-01-20 03:24:56 |
Jeremy Bícha |
description |
Another bubblewrap security issue. This has been fixed in Debian and upstream in both bubblewrap and Flatpak which need to be updated at the same time.
I've been wanting to update Flatpak to 0.8 anyway (LP: #1656712) since December but was waiting to get bubblewrap taken care of first to make it simpler. Now I guess we'll do it all together.
There are three affected packages in yakkety:
- bubblewrap
- flatpak
- ostree (new version needed for new flatpak)
I'll attach debdiffs here for them.
I propose we do like the last bubblewrap update and build these as security updates but age them for 7 days first like SRUs. |
Another bubblewrap security issue for yakkety. Changelogs are derived from Debian's. This has already been fixed in Debian and zesty.
This has been fixed in Debian and upstream in both bubblewrap and Flatpak which need to be updated at the same time.
For Flatpak, this is just backporting
https://github.com/flatpak/flatpak/commit/902fb7139
For bubblewrap, there's only a few other bugfixes added in the new upstream version 0.1.7 since 0.1.5 so I think we'd be better off just taking the new version:
https://github.com/projectatomic/bubblewrap/releases
https://github.com/projectatomic/bubblewrap/commits/master
Originally, I mixed this bug with LP: #1656712 but it's a lot simpler now. |
|
| 2017-01-28 10:17:28 |
Jeremy Bícha |
attachment removed |
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4806561/+files/flatpak-yakkety-lp1657357.debdiff |
|
|
| 2017-01-28 10:19:15 |
Jeremy Bícha |
attachment added |
|
flatpak-yakkety-lp1657357.debdiff https://bugs.launchpad.net/ubuntu/+source/bubblewrap/+bug/1657357/+attachment/4810032/+files/flatpak-yakkety-lp1657357.debdiff |
|
| 2017-02-06 15:23:01 |
Tyler Hicks |
bubblewrap (Ubuntu): status |
New |
Confirmed |
|
| 2017-02-06 15:23:08 |
Tyler Hicks |
flatpak (Ubuntu): status |
New |
Confirmed |
|
| 2017-02-10 00:54:30 |
Launchpad Janitor |
flatpak (Ubuntu): status |
Confirmed |
Fix Released |
|
| 2017-02-10 00:54:32 |
Launchpad Janitor |
bubblewrap (Ubuntu): status |
Confirmed |
Fix Released |
|
