Bug 918058

Summary:	GNU patch update breaks legitimate use of symbolic links
Product:	[openSUSE] openSUSE 13.1	Reporter:	Jean Delvare <jdelvare>
Component:	Development	Assignee:	Jean Delvare <jdelvare>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P2 - High	CC:	astieger, jsegitz
Version:	Final
Target Milestone:	---
Hardware:	All
OS:	openSUSE 13.1
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	Test case

Description Jean Delvare 2015-02-16 11:39:49 UTC

The security fix for bug #913678 breaks legitimate use cases of relative symbolic links. Upstream has reverted the security hot fix:

http://git.savannah.gnu.org/cgit/patch.git/commit/?id=290ffcb488bea5caec6d76a34ea8368d00c68875

And instead implemented a secure way of handling symbolic links:

http://git.savannah.gnu.org/cgit/patch.git/commit/?id=025a54b789bd88ed15430f8633514e296826983e
http://git.savannah.gnu.org/cgit/patch.git/commit/?id=71a3172c7ecb1fad7965843ba373e99a034ee1ce

This new approach no longer breaks legitimate use cases. This is all in GNU patch version 2.7.4, so I think we want to trigger another maintenance update.

Comment 1 Jean Delvare 2015-02-16 11:43:21 UTC

Created attachment 623415 [details]
Test case

This simple patch can be applied with GNU patch versions 2.7.1, 2.7.2 and 2.7.4, but version 2.7.3 fails to apply it with the following error message:

symbolic link target '../foo' is invalid

Comment 2 Jean Delvare 2015-03-07 09:28:52 UTC

Version 2.7.4 introduced another functional regression, which is fixed in the just release version 2.7.5 of GNU patch. This version should hopefully be suitable for a maintenance update in openSUSE 13.1 and 13.2.

Comment 3 Johannes Segitz 2015-04-10 08:05:42 UTC

(In reply to Jean Delvare from comment #2)
Can you please submit for openSUSE 13.[12]?

Comment 4 Jean Delvare 2015-06-01 11:37:58 UTC

Submitted:

https://build.opensuse.org/request/show/309612

Comment 5 Swamp Workflow Management 2015-06-08 08:05:30 UTC

openSUSE-RU-2015:1010-1: An update that has one recommended fix can now be installed.

Category: recommended (moderate)
Bug References: 918058
CVE References: 
Sources used:
openSUSE 13.2 (src):    patch-2.7.5-7.7.1
openSUSE 13.1 (src):    patch-2.7.5-4.7.1

Comment 6 Andreas Stieger 2015-06-08 08:17:52 UTC

update released