Mailing-List: contact dev-help@apr.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 209.132.183.28 as permitted sender)
Date: Tue, 28 Sep 2010 16:22:04 +0100
From: Joe Orton <jorton@redhat.com>
To: Jeff Trawick <trawick@gmail.com>
Cc: dev@apr.apache.org
Subject: Re: intent to T&R apr-util 1.3.10 sometime Thursday
Message-ID: <20100928152204.GA27621@redhat.com>
Mail-Followup-To: Jeff Trawick <trawick@gmail.com>, dev@apr.apache.org
References: <AANLkTinnATAQPD+h+zAV7K79X46owWg6g-OBnjy1oDze@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <AANLkTinnATAQPD+h+zAV7K79X46owWg6g-OBnjy1oDze@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-08-17)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Tue, Sep 28, 2010 at 07:05:09AM -0400, Jeff Trawick wrote:
> any concerns about the timing?
> any additional fixes people would like to see in that release?

I have been trying to backport security fixes for CVE-2009-3720 and 
CVE-2009-3560 to the bundled copy of expat but am getting nowhere.  The 
patches available work for 1.95.8 and later, but apr-util bundles 1.95.2 
which is significantly different :(

These are both issues which can segfault the XML parser when parsing 
particular (invalid) documents; a pertinent issue e.g. for those running 
public DAV servers.

I'm not sure what to recommend here; we could either ship with known 
vulnerabilities, attempt to upgrade the bundled expat to a more recent 
version, or drop the bundled expat altogether for new releases.  None of 
these seem attractive.  (The latest upstream is expat 2.0.1, which 
doesn't have the security fixes applied and 2.x breaks ABI with 1.95.x 
to boot)

Regards, Joe