search

nim-lang / security

Embargoed security issues that will be made public after a fix is made available. Use https://github.com/nim-lang/security/security
5 stars 2 forks source link

Backport SSL fixes to 1.0.x and release with new Nimble #2

Open dom96 opened 3 years ago

dom96 commented 3 years ago

We need to do the following AFAIK:

FedericoCeratto commented 3 years ago

Summary: Issue: Nimble does not check SSL certs during update Affected Nim releases: all, up to 1.4 (inclusive) To be fixed: 1.0 1.2 1.4 Wontfix: < 1.0 Fixed in: ? CVE: none yet

alaviss commented 3 years ago

A small reminder that we have to issue a security notice. Preferably as soon as possible, given that the bugs had been disclosed.

dom96 commented 3 years ago

Can this be closed now?

alaviss commented 3 years ago

Have we published any security advisory?

FedericoCeratto commented 3 years ago

I suggest updating the summary above

FedericoCeratto commented 3 years ago

@dom96 @Araq - it seems that nobody has been opening CVEs for this and other issues. I can create them as draft using https://github.com/nim-lang/Nim/security for both Nim and Nimble if given access. The process is more lightweight now and we can get CVEs assigned through github.

@narimiran once assigned, CVEs could be added to the changelog of the last releases.

alaviss commented 3 years ago

@Araq @narimiran

It doesn't appear to me that we mention the RCE bug at all in the latest release note: https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html

Is this fixed for 1.0? If it's not then we need a 1.0 release too.

FedericoCeratto commented 3 years ago

@Araq you gave a thumbs up but I don't have permissions to create a draft advisory on https://github.com/nim-lang/Nim/security/advisories

Araq commented 3 years ago

@FedericoCeratto Made you an admin, let's see if it works...

FedericoCeratto commented 3 years ago

@Araq I cannot create draft advisories on the Nim repo but I was able to create them in this one. Some are pending on CVEs being assigned.

The drafts are hidden to the public until published, then they follow the public/private repo settings. I suggest we make this repo public and use it for future advisories.

FedericoCeratto commented 3 years ago

@Araq GitHub said they cannot assign a CVE unless this repo (https://github.com/nim-lang/security) is made public: https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx#advisory-comment-64763

Araq commented 3 years ago

Ok, so we need to file an issue for this on nim-lang/nim then. Right?

Araq commented 3 years ago

nim-lang/security should not be made public, it's for reporting security related bugs, we should make them public after a fix for these is available.

FedericoCeratto commented 3 years ago

To summarize:

  1. I cannot create advisories at https://github.com/nim-lang/Nim/security/advisories due to github permissions
  2. I created them as draft https://github.com/nim-lang/security/security/advisories
  3. draft advisories are kept secret by github regardless of the public/private status of the repository
  4. github needs the repository (not the advisories) to be public to assign CVE numbers to draft advisories
  5. Once completed/fixed, advisories go from draft to public and become visible to everybody

In short: the embargo mechanism is already built-in in github's advisories workflow.

FedericoCeratto commented 3 years ago

@Araq any thought? It would be nice if we could make some progress.

Araq commented 3 years ago

I made this repository public days ago. Sorry, I thought I had told you. :-)