On Tue, Nov 28, 2023 at 8:37 AM Ben Beasley <c...@musicinmybrain.net> wrote:
> This email proposes upgrading the llhttp package in EPEL9 from 8.1.1 to > 9.1.3, which would break the ABI and bump the SONAME version, under the > EPEL Incompatible Upgrades Policy[1]. > > The llhttp package is a C library (transpiled from TypeScript) that > provides the low-level HTTP support for NodeJS and for python-aiohttp. > Currently, only python-aiohttp depends on the llhttp package in EPEL9. > > Versions of python-aiohttp prior to 3.8.6[2] are affected by > CVE-2023-47627[3][4], an HTTP request/response smuggling vulnerability > rated 5.3 in CVSS v3 and rated Moderate by Red Hat. This was reported as > RHBZ#2249825[5]. Since the flaw is only in the pure-Python parser, and > we compile the llhttp-based parser, this affects only code using the > AIOHTTP_NO_EXTENSIONS environment variable. Updating aiohttp from 3.8.5 > to 3.8.6 to fix that still requires updating llhttp from 8.x to 9.x. > Additionally, according to the release notes this includes an > llhttp-related security fix[6] with no assigned CVE, which provides > added motivation to update. > > The ABI break in llhttp would only affect python-aiohttp. The > python-aiohttp update itself is compatible (by upstream intent, and as > already demonstrated in Rawhide and F39/F38); and a large list of > packages that depend on python-aiohttp would benefit from the fix. The > necessary rebuild would be conducted in a side tag. > > The same incompatible update was approved by FESCo for Fedora 38 and > 39[7]. Furthermore, it appears that FESCo will approve a permanent > exception for llhttp[8]. > > The purpose of this email is to document and explain the proposed > update, to begin the minimum one-week discussion period mandated by the > EPEL Incompatible Upgrades Policy, and to request that the update be > added to the agenda for an upcoming EPEL meeting. > > [1] > > https://docs.fedoraproject.org/en-US/epel/epel-policy-incompatible-upgrades/#process_for_incompatible_upgrades > > [2] https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6 > > [3] https://access.redhat.com/security/cve/CVE-2023-47627 > > [4] > https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg > > [5] https://bugzilla.redhat.com/show_bug.cgi?id=2249825 > > [6] https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6 > > [7] https://pagure.io/fesco/issue/3106 > > [8] https://pagure.io/fesco/issue/3115 > > This exception, as well as a permanent exception, was approved this week in the EPEL Steering Committee meeting. Troy
-- _______________________________________________ epel-devel mailing list -- epel-devel@lists.fedoraproject.org To unsubscribe send an email to epel-devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
