<qyliss>
There's a security cleanup sprint happening at NixCon right now
<qyliss>
Not sure who's participating
<ris>
#71872
<{^_^}>
https://github.com/NixOS/nixpkgs/pull/71872 (by risicle, 3 days ago, open): [r19.09] ghostscript: add patches for CVE-2019-10216, CVE-2019-14811, CVE-2019-14812, CVE-2019-14813 and some of CVE-2019-14817
<ckauhaus>
ris: looks like you have permission to trigger ofBorg builds
<ckauhaus>
(looking at the qemu PR)
<ris>
yeah seems so
<ris>
forgot about that
<ris>
and the rpyc one has been superseded by a mass bump it seems
<ckauhaus>
ris: I've acquired merge rights a moment ago and will take care of it
<marek>
ris: mmahut is me actually
ivan has quit [Ping timeout: 268 seconds]
ivan has joined #nixos-security
pie_ has quit [Ping timeout: 240 seconds]
<ris>
ahhhhhhhh
tilpner has quit [Quit: tilpner]
tilpner has joined #nixos-security
tilpner has quit [Quit: tilpner]
tilpner has joined #nixos-security
justanotheruser has quit [Ping timeout: 240 seconds]
<ckauhaus>
ris: just trying to build qemu with all recent patches
<ckauhaus>
takes aaaaages
<ris>
yeah it's all the architectures i think
<ris>
i'm building... an interrupt controller emulator... for a powermac..
ryantm has joined #nixos-security
<ryantm>
ckauhaus: I was thinking for now, what I'd do to handle the vendor ambiguity in CPE matching is to make a mapping of attrpath to vendor, but maybe a better solution would be to include the vendor in the meta information. With the Apache Thrift example maybe `pkgs.thrift.meta.cpe.vendor = "apache"`
<ckauhaus>
perhaps
<ckauhaus>
the problem is the NVD data is such a mess
<ckauhaus>
for example, git's vendor is sometimes listed as "git", sometimes as "git project", sometimes as "git-scm"
<ryantm>
and it isn't clear which one is the canonical vendor name either, I guess.
<ckauhaus>
the data model itself is unsuitable
<ckauhaus>
for many open source projects, there is no such concept as a 'vendor'
<ckauhaus>
even worse: on the other hand we have large languague specific ecosystems like pypi, cpan, rubygems, ... and these don't fit into the vendor/product scheme at all
<ryantm>
ckauhaus: I guess the goal should be to try to cast a wide net of possible CVEs then use some approach to mark ones as invalid. Like it would be okay to say Apache Thrift should NOT report CVEs that have vendor "Facebook", but saying the vendor will definitely be "apache" might exclude something legitimate.
<ckauhaus>
yeah
<ryantm>
So probably I need a curated mapping from attrpath -> to list of matchers and a curated mapping from attrpath to blacklisted CVE matchers
<ckauhaus>
in practice, this is often catched by version mismatches