Bug#1008235: Acknowledgement (bash: corrupting variables containing long unicode content)

2022-03-26 Thread Leszek Dubiel



Some more info:


On Ubuntu 21.04 the bug is not present:   bash has version 
"5.1-2ubuntu1" and libc6 has version "2.33-0ubuntu5".




Bug#1008235: Acknowledgement (bash: corrupting variables containing long unicode content)

2022-03-26 Thread Leszek Dubiel



I have just upgraded to debian version 11.3.


Bug is still there:



root@orion:~# cat /etc/debian_version
11.3

root@orion:~# ./make_test.sh
there is a BUG on your system...
-xx-x--x-- 1     5551 2022-03-11 14:45:33.671864216 +0100 
../x_//_x/xx_378649_01_Ł�xx
-xx-x--x-- 1     5551 2022-03-11 14:45:33.671864216 +0100 
../x_//_x/xx_378649_01_Śxx
-xx-x--x-- 1    2194 2022-03-16 15:45:30.808233919 +0100 
../x_//_x/xx_378884_11_łx0
-xx-x--x-- 1    2194 2022-03-16 15:45:30.808233919 +0100 
../x_//_x/xx_378884_11_Ł�x0
-xx-x--x-- 1    2927 2022-03-14 13:00:29.878538837 +0100 
../x_//_x/xx_378748_01_Ł�xx
-xx-x--x-- 1    2927 2022-03-14 13:00:29.878538837 +0100 
../x_//_x/xx_378748_01_Śxx




root@orion:~# bash --version
GNU bash, wersja 5.1.4(1)-release (x86_64-pc-linux-gnu)


root@orion:~# dpkg -l | grep bash
ii  bash   5.1-2+b3  amd64    GNU Bourne Again SHell




I think this sould be marked as critical bug or security threat.


Please tell what should we do:

-- wait a few more days and upgrade system again
-- or backport bash from next release?



Bug#1008235: Acknowledgement (bash: corrupting variables containing long unicode content)

2022-03-26 Thread Leszek Dubiel


I believe this is the same bug as reported in 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003012 and upstream 
in https://lists.gnu.org/archive/html/bug-bash/2022-01/msg0.html


Hmm... looks sililar. Thank you.

So what should we do now? Upgrade bash from testing? Or wait until 
stable debian is upgraded?
I am afraid of silent data corruption on production server where we use 
debian stable...




Bug#1008235: Acknowledgement (bash: corrupting variables containing long unicode content)

2022-03-25 Thread Eduardo Bustamante
On Fri, Mar 25, 2022 at 3:36 PM Leszek Dubiel  wrote:

>
> Some more tests were done on:
>
> - ubuntu 22.04 (5.15.0-23)
> - ubuntu 20.04 (5.13.0-35)
> - fedora 35 (5.14.10-300)
> - debian 10 (4.19.0-19)
> - debian 11 (5.10.0-11) - bash 5.1-2
> - debian testing (5.16.0-5)
>
> Error is only on debian 11.
>
> If you upgrade bash 5.1-2 to 5.1-6 then but is resolved.
>
> So the bug maybe is only in bash version 5.1-2
>

I believe this is the same bug as reported in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003012 and upstream in
https://lists.gnu.org/archive/html/bug-bash/2022-01/msg0.html


Bug#1008235: Acknowledgement (bash: corrupting variables containing long unicode content)

2022-03-25 Thread Leszek Dubiel



Some more tests were done on:

- ubuntu 22.04 (5.15.0-23)
- ubuntu 20.04 (5.13.0-35)
- fedora 35 (5.14.10-300)
- debian 10 (4.19.0-19)
- debian 11 (5.10.0-11) - bash 5.1-2
- debian testing (5.16.0-5)

Error is only on debian 11.

If you upgrade bash 5.1-2 to 5.1-6 then but is resolved.

So the bug maybe is only in bash version 5.1-2