search

Yubico / yubikey-neo-manager

Cross platform personalization tool for the YubiKey NEO
https://developers.yubico.com/yubikey-neo-manager/
BSD 2-Clause "Simplified" License
56 stars 12 forks source link

Security issues with WebKit #59

Closed eworm-de closed 7 years ago

eworm-de commented 7 years ago

Currently yubikey-neo-manager depends on PySide and QtWebKit. This pulls in old WebKit, which brings some security implications [0]. ArchLinux is about to remove the packages webkitgtk and webkitgtk2 from official repositories [1][2], packages depending on these will be removed as well. Probably other distributions will follow. So please implement the functionality with another backend and drop QtWebKit.

[0] https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/ [1] https://www.archlinux.org/todo/phasing-out-webkitgtk2/ [2] https://www.archlinux.org/todo/phasing-out-qtwebkit/

phw commented 7 years ago

I just saw commit https://github.com/Yubico/yubikey-neo-manager/commit/94859366f054636acc13f47fa02f2fbd0134da41 , where it is being made clear that this app is deprecated and replaced by Yubikey Manager. So probably the fix here for us users is to just remove this application and install the new Yubikey Manager. I did this on my arch install and it was the last thing preventing me from dropping qtwebkit completely :D

dagheyman commented 7 years ago

Yes, what @phw said.