Date: Tue, 24 Jan 2017 13:46:04 +0100 From: Hanno Böck <hanno@...eck.de> To: oss security list <oss-security@...ts.openwall.com> Subject: Windows ports of Linux software bundling outdated libraries (Gajim / PyCurl) Hi, I feel I've opened a can of worms here. In a comment on the news site heise a reader pointed out that Gajim for windows ships very old versions of OpenSSL and Python . I decided to have a look and gajim indeed bundled files SSLEAY32.dll and LIBEAY32.dll that came from OpenSSL 0.9.8l. However it seems that was the least of the problems, as these are probably just some leftover and not used by anything. However, as it turns out gajim ships several copies of old versions of OpenSSL (bug report here ). The source of those is actually that gajim itself uses other projects, mentioned in the bug report are gtk+, pycurl and cryptodome. I verified that for pycurl, which provides a windows installer that bundles the curl and openssl version at the time of the last release, which was in June 2015. Note that it seems pycurl matches the version numbers of curl, however the latest release is 7.43.0. On linux systems it'll use whatever curl is on the system, which can be newer, so everything's fine, but the windows installer bundles the matching 7.43.0 curl version, which is quite old. Notably it was long before the recent audit of curl, which uncovered a large number of security vulnerabilities. I reported this to pycurl as well . The moral of the story is probably that if you recommend windows ports of your favorite linux desktop application to your windows using friends you may want to check if they bundle some really outdated stuff. I encourage everyone to watch out for similar issues and report them to the affected projects.  https://www.heise.de/forum/heise-Security/News-Kommentare/XMPP-Jabber-Krypto-Messenger-ChatSecure-verschluesselt-mit-OMEMO-Protokoll/Gajim-Release-enthaelt-uralte-Versionen-von-Python-OpenSSL/posting-29818036/show/  https://dev.gajim.org/gajim/gajim/issues/8513  https://github.com/pycurl/pycurl/issues/437 -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.