search

Unidata / gempak

Analysis and product generation for meteorological data.
BSD 3-Clause "New" or "Revised" License
69 stars 30 forks source link

zlib upgrade for CVE-2018-25032 #106

Closed oxelson closed 2 years ago

oxelson commented 2 years ago

Upgrade to 1.2.12

akrherz commented 2 years ago

Thanks @oxelson , but doesn't the actual zlib 1.2.12 source need included as well?

oxelson commented 2 years ago

le sigh Sorry @akrherz! It's been a day. I'll get that added. 🤪

akrherz commented 2 years ago

Whelp, CI is green here, but is 1) not good and 2) makes me realize what the docker images were doing with extlibs. Ufff

oxelson commented 2 years ago

I double checked and did grab the source code for the latest zlib and put in the symlink -- but the v1.2.12 directory & contents were not pushed to the repo...? Sorry about that. I'll correct it.

Whelp, CI is green here, but is 1) not good and 2) makes me realize what the docker images were doing with extlibs. Ufff

How did you want to proceed?

akrherz commented 2 years ago

@oxelson I am unsure. It would certainly be nice just to jettison zlib from extlibs and let the OS provide the library, but that may be a bridge too far.

oxelson commented 2 years ago

I had to comment of the extlibs/ in .gitignore to get the libz source code added.

It would certainly be nice just to jettison zlib from extlibs and let the OS provide the library, but that may be a bridge too far.

I'll defer to you on this. Either way, we should probably rebuild gempak with the new/safe version of zlib and make that available. :-)

akrherz commented 2 years ago

we should probably rebuild gempak

We are not distributing binaries at this time, I am still boggling this.

oxelson commented 2 years ago

We are not distributing binaries at this time, I am still boggling this.

Sounds good. 👍

akrherz commented 2 years ago

Thanks again @oxelson , will take this once CI passes.