Your message dated Wed, 25 Nov 2015 09:36:51 +0000 with message-id <[email protected]> and subject line Bug#786817: fixed in yash 2.39-1 has caused the Debian Bug report #786817, regarding yash: fieldsplitting data corruption to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 786817: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786817 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: yash Version: 2.36-1 Severity: critical When doing field-splitting, fields starting with backslashes are corrupted: starting from the 2nd field, they have their initial backslashes removed. Only the first field is left intact. Given a default $IFS: testfn() { printf '%s\n' "$@" } VAR='\o\ne \t\wo \th\r\ee \fo\ur' testfn $VAR Got output: \o\ne t\wo th\r\ee fo\ur Expected ouput (produced on every POSIX shell except yash): \o\ne \t\wo \th\r\ee \fo\ur Clearly, this sort of data corruption is a critical security problem. Lack of data integrity is just the beginning. Removal of backslashes might defeat quoting/escaping of critical data and lead to the execution of arbitrary commands. For instance, what if some script feeds the result of improper fieldsplitting to "eval"? Upstream fixed the bug in SVN after my report: http://osdn.jp/projects/yash/scm/svn/commits/3298 But the author does not treat it with urgency and has neither announced the bug nor patched/updated/withdrawn the release version, which clearly should not be used with a bug like this. So Debian should issue a patch for its packaged version in the meantime.
--- End Message ---
--- Begin Message ---Source: yash Source-Version: 2.39-1 We believe that the bug you reported is fixed in the latest version of yash, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. TANIGUCHI Takaki <[email protected]> (supplier of updated yash package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 25 Nov 2015 18:02:13 +0900 Source: yash Binary: yash Architecture: source amd64 Version: 2.39-1 Distribution: unstable Urgency: medium Maintainer: TANIGUCHI Takaki <[email protected]> Changed-By: TANIGUCHI Takaki <[email protected]> Description: yash - yet another shell Closes: 786817 Changes: yash (2.39-1) unstable; urgency=medium . * debian/watch: Change listing page. * Imported Upstream version 2.39 + Fix "fieldsplitting data corruption" (Closes: #786817) Checksums-Sha1: a4d52032a4497edc36d2b1dc5b35c94a741c89d0 1820 yash_2.39-1.dsc 4e176ec220b977f395c9fb7c4f27e4112abc74a9 648688 yash_2.39.orig.tar.xz 0c95a8a787b7b2c5bc34d07b8608a7f1e777d563 4644 yash_2.39-1.debian.tar.xz 7ea7f934fd554670b4e083f85ec45c886ff666d1 405356 yash_2.39-1_amd64.deb Checksums-Sha256: 9017ecc84af7adbdaea31c2d8d0db72eea81854af1e14837274c874315a5a3c7 1820 yash_2.39-1.dsc d284c8b253e6ce8bea5e28dfe9c2214512232d0f0e67257440623fa4225c3bde 648688 yash_2.39.orig.tar.xz d04208288637fe3078b59d2388f3e98ea5fc3a832b37dd0c40dca72deb83d24d 4644 yash_2.39-1.debian.tar.xz 976e454f71c9bbfad90ece2db2f7e3812748383277e60df0076c77eb7f219add 405356 yash_2.39-1_amd64.deb Files: 1e10e830092c77532d3c817bb80f62a9 1820 shells extra yash_2.39-1.dsc 6daad5e1c9d92acb50985236330ceeee 648688 shells extra yash_2.39.orig.tar.xz bf15bc7f125299d3fc41dd00313df334 4644 shells extra yash_2.39-1.debian.tar.xz 7debbb695d3c1ac5e08b08e3635857ec 405356 shells extra yash_2.39-1_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWVXlJAAoJEMwUn2wopeJXItEP/jP3sfX+lqI3F5CJ3qvfJfTu 1C5xtVJXYxl3q1A0hGAQJ/Hs2+2veGeg49pXKP467cVsOhyKCvpRz4kiXUpF52PO xGF4Ak+/jDBJKfRw2A7cp5y797fBL9UPGy0R+giMrYrd5VUzK1iU2jM/22vhgTZL RDotnTm/6ia7HRPk82Ze3ZFKXoUH/+ugCw+qJ4a9/+Y5OeyvnACzwF8gqHAmSm+c IKWYPeXVg8XK6hNBUiYY1Ki/ZEc/MEQ+rDgH2fKBIUMmm87bDeJ6zSQdERPfQylR apGpxVVVM51gZvjYFFV3ItzBz04keMRftSTXDSEGryJodGSnZgaBmO3Uwmk6Q19z 0wrxMnphdVw70lpZRTz7H1mQQeCGFrUWMcNgSZYGCSsEbOxqG3IloIc8z+T2Zdfa Y5nSvwZYb2tkbbBxj/7MJD61v4YOJVAeb7ngpneOu/eL4ORe8i75IEL5cmIouj3S NdrYwo8IB3pKU/KTar7yk4+s9gXJOZ3bHSnagg32yPcrEbdGz5QqLpMbEBUGDhND 9177VEnqZfenNIFs6GVRjlBIVjtlNh8RiVXZsVxmf1AMHKOevSE+/ZVm0yQNXzLL 1WBAc1MgqvToImWvJFqJEVmRlRaI7vDA/iPLAKgxmAuR4BU9FZz6IXDup+28+B2y fz35IGoBKO2oY0EUZac4 =zMWJ -----END PGP SIGNATURE-----
--- End Message ---
