Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-25 Thread Sebastian Andrzej Siewior 
On 2022-01-25 18:46:16 [+], Adam D. Barratt wrote:
> For the record, .5 was released via {buster,bullseye}-updates last
> night; see SUA211-1 / 
> https://lists.debian.org/debian-stable-announce/2022/01/msg1.html

Thank you.

> Regards,
> 
> Adam

Sebastian

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-25 Thread Adam D. Barratt 
On Sun, 2022-01-16 at 19:09 +, Adam D. Barratt wrote:
> On Fri, 2022-01-14 at 21:51 +0100, Sebastian Andrzej Siewior wrote:
> > > Speaking of latest patch version: Upstream released today .5.
> > > Would
> > > you
> > > prefer to wait with this until I upload .5 to unstable and
> > > stable/oldstable for this (and avoiding a second announcement)?
> > 
> > I assume a direct update to .5 is preferred so I attached it here.
> > Regarding the wording: in [0] upstream says that they are going to
> > block 0.102 and earlier from database updates so we should be good.
> > That means they did not mention to block previous 0.103 releases so
> > there is probably no need to add stronger wording as I suggested.
> > The NEWS file mentions a CVE which looks harmless in typical mail
> > server setup since it requires an additional option for scanning.
> > 
> > I have it in unstable since the 12th and deployed the Buster
> > version
> > on a server and had the regular testing for Bullseye.
> 
> Sorry, things have been a little hectic recently.
> 
> Updating to .5 seems to make sense for everyone; thanks.
> 

For the record, .5 was released via {buster,bullseye}-updates last
night; see SUA211-1 / 
https://lists.debian.org/debian-stable-announce/2022/01/msg1.html

Regards,

Adam

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-16 Thread Adam D. Barratt 
On Fri, 2022-01-14 at 21:51 +0100, Sebastian Andrzej Siewior wrote:
> > Speaking of latest patch version: Upstream released today .5. Would
> > you
> > prefer to wait with this until I upload .5 to unstable and
> > stable/oldstable for this (and avoiding a second announcement)?
> 
> I assume a direct update to .5 is preferred so I attached it here.
> Regarding the wording: in [0] upstream says that they are going to
> block 0.102 and earlier from database updates so we should be good.
> That means they did not mention to block previous 0.103 releases so
> there is probably no need to add stronger wording as I suggested.
> The NEWS file mentions a CVE which looks harmless in typical mail
> server setup since it requires an additional option for scanning.
> 
> I have it in unstable since the 12th and deployed the Buster version
> on a server and had the regular testing for Bullseye.

Sorry, things have been a little hectic recently.

Updating to .5 seems to make sense for everyone; thanks.

Regards,

Adam

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-14 Thread Sebastian Andrzej Siewior 
On 2022-01-12 20:44:46 [+0100], To Adam D. Barratt wrote:
> > I wasn't really sure which of the changes made sense to mention, but
> > had a go at an initial draft for an announcement. Tweaks, updates or
> > complete rewrites welcome:
> > 
> > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> > ClamAV is an AntiVirus toolkit for Unix.
> > 
> > Upstream published version 0.103.4.
> > 
> > This is a bug-fix release and an upstream LTS release. The changes are not
> > currently required for operation, but upstream strongly recommends that 
> > users
> > update.
> 
> Maybe adding something like
>   ", but upstream strongly recommends that users update for continued
>   support."
> 
> Upstream asks to use latest patch level version for support which
> includes access to the signature database.
> 
> Speaking of latest patch version: Upstream released today .5. Would you
> prefer to wait with this until I upload .5 to unstable and
> stable/oldstable for this (and avoiding a second announcement)?

I assume a direct update to .5 is preferred so I attached it here.
Regarding the wording: in [0] upstream says that they are going to
block 0.102 and earlier from database updates so we should be good. That
means they did not mention to block previous 0.103 releases so there is
probably no need to add stronger wording as I suggested.
The NEWS file mentions a CVE which looks harmless in typical mail server
setup since it requires an additional option for scanning.

I have it in unstable since the 12th and deployed the Buster version on
a server and had the regular testing for Bullseye.

[0] https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html

> > Regards,
> > 
> > Adam

Sebastian
diff -Nru clamav-0.103.4+dfsg/clamav-milter/clamav-milter.c clamav-0.103.5+dfsg/clamav-milter/clamav-milter.c
--- clamav-0.103.4+dfsg/clamav-milter/clamav-milter.c	2021-11-02 16:47:46.0 +0100
+++ clamav-0.103.5+dfsg/clamav-milter/clamav-milter.c	2022-01-11 00:17:45.0 +0100
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+ *  Copyright (C) 2013-2022 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
  *  Copyright (C) 2008-2013 Sourcefire, Inc.
  *
  *  Author: aCaB 
@@ -96,7 +96,7 @@
 
 sigset_t sigset;
 struct sigaction act;
-const char * user_name = NULL;
+const char *user_name = NULL;
 
 cl_initialize_crypto();
 
@@ -122,7 +122,7 @@
 printf("\n");
 printf("   Clam AntiVirus: Milter Mail Scanner %s\n", get_version());
 printf("   By The ClamAV Team: https://www.clamav.net/about.html#credits\n;);
-printf("   (C) 2021 Cisco Systems, Inc.\n");
+printf("   (C) 2022 Cisco Systems, Inc.\n");
 printf("\n");
 printf("%s [-c ]\n\n", argv[0]);
 printf("\n");
@@ -158,7 +158,7 @@
 }
 free(pt);
 
-if ((opt = optget(opts, "User"))->enabled){
+if ((opt = optget(opts, "User"))->enabled) {
 user_name = opt->strarg;
 }
 
@@ -419,7 +419,7 @@
 if ((opt = optget(opts, "PidFile"))->enabled) {
 FILE *fd;
 mode_t old_umask = umask(0002);
-int err = 0;
+int err  = 0;
 
 if ((fd = fopen(opt->strarg, "w")) == NULL) {
 logg("!Can't save PID in file %s\n", opt->strarg);
@@ -434,14 +434,14 @@
 umask(old_umask);
 
 #ifndef _WIN32
-if (0 == err){
+if (0 == err) {
 /*If the file has already been created by a different user, it will just be
  * rewritten by us, but not change the ownership, so do that explicitly.
  */
-if (0 == geteuid()){
-struct passwd * pw = getpwuid(0);
-int ret = lchown(opt->strarg, pw->pw_uid, pw->pw_gid);
-if (ret){
+if (0 == geteuid()) {
+struct passwd *pw = getpwuid(0);
+int ret   = lchown(opt->strarg, pw->pw_uid, pw->pw_gid);
+if (ret) {
 logg("!Can't change ownership of PID file %s '%s'\n", opt->strarg, strerror(errno));
 err = 1;
 }
@@ -449,7 +449,7 @@
 }
 #endif /*_WIN32*/
 
-if (err){
+if (err) {
 localnets_free();
 whitelist_free();
 logg_close();
@@ -460,7 +460,7 @@
 
 #ifndef _WIN32
 dropPrivRet = drop_privileges(user_name, logg_file);
-if (dropPrivRet){
+if (dropPrivRet) {
 optfree(opts);
 return dropPrivRet;
 }
@@ -468,7 +468,7 @@
 /* We have been daemonized, and initialization is done.  Signal
  * the parent process so that it can exit cleanly.
  */
-if (parentPid != getpid()){ //we have been daemonized
+if (parentPid != getpid()) { //we have been daemonized
 daemonize_signal_parent(parentPid);
 }
 #endif
diff -Nru clamav-0.103.4+dfsg/clamd/clamd.c

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-12 Thread Sebastian Andrzej Siewior 
On 2022-01-11 21:17:54 [+], Adam D. Barratt wrote:
> Now that the equivalent update made it to stretch, this seems as good a
> time as any - I'm assuming that no major issues have ben reported in
> unstable in the meantime?

correct.

> I wasn't really sure which of the changes made sense to mention, but
> had a go at an initial draft for an announcement. Tweaks, updates or
> complete rewrites welcome:
> 
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> ClamAV is an AntiVirus toolkit for Unix.
> 
> Upstream published version 0.103.4.
> 
> This is a bug-fix release and an upstream LTS release. The changes are not
> currently required for operation, but upstream strongly recommends that users
> update.

Maybe adding something like
  ", but upstream strongly recommends that users update for continued
  support."

Upstream asks to use latest patch level version for support which
includes access to the signature database.

Speaking of latest patch version: Upstream released today .5. Would you
prefer to wait with this until I upload .5 to unstable and
stable/oldstable for this (and avoiding a second announcement)?

> Changes since 0.103.3 currently in buster and bullseye include fixes for
> several possible crashes, corrected handling of 0-byte incremental database
> updates and the renaming of several heuristic-based alerts.
> 
> If you use clamav, we recommend that you install this update.
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> 
> Regards,
> 
> Adam

Sebastian

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2022-01-11 Thread Adam D. Barratt 
On Thu, 2021-12-23 at 21:22 +0100, Sebastian Andrzej Siewior wrote:
> On 2021-12-23 15:38:16 [+], Adam D. Barratt wrote:
[...]
> > Were you anticipating that 0.103.4 would get published via
> > -updates, or
> > simply with the next point releases?
> 
> it would be good to get it published via -updates. No need to rush.

Now that the equivalent update made it to stretch, this seems as good a
time as any - I'm assuming that no major issues have ben reported in
unstable in the meantime?

I wasn't really sure which of the changes made sense to mention, but
had a go at an initial draft for an announcement. Tweaks, updates or
complete rewrites welcome:

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
ClamAV is an AntiVirus toolkit for Unix.

Upstream published version 0.103.4.

This is a bug-fix release and an upstream LTS release. The changes are not
currently required for operation, but upstream strongly recommends that users
update.

Changes since 0.103.3 currently in buster and bullseye include fixes for
several possible crashes, corrected handling of 0-byte incremental database
updates and the renaming of several heuristic-based alerts.

If you use clamav, we recommend that you install this update.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Regards,

Adam

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2021-12-23 Thread Sebastian Andrzej Siewior 
On 2021-12-23 15:38:16 [+], Adam D. Barratt wrote:
> Hi,
Hi Adam,

> fwiw, even with the reduced diffs, neither request made it to debian-
> release.

Oh shoot. You're the best Adam. I meant to ping the list in case it
didn't make through but forgot to check…

> Were you anticipating that 0.103.4 would get published via -updates, or
> simply with the next point releases?

it would be good to get it published via -updates. No need to rush.

> Regards,
> 
> Adam

Sebastian

Bug#1002298: bullseye-pu: package clamav/0.103.4+dfsg-0+deb11u1

2021-12-23 Thread Adam D. Barratt 
Hi,

On Tue, 2021-12-21 at 22:01 +0100, Sebastian Andrzej Siewior wrote:
> This is an update to clamav package to the current LTS version
> 0.103.4.
> The update contains various fixes, none of them were classified as
> critical however the NEWS.md mentions a few descriptor and memory
> leaks.
> Freshclam received a few fixes in response to zero-byte CDIFF updates
> which was not handled very well and was reported a few times.
> 
> The packag is aligned with unstable upload.
> I also added the man-page for clamonacc (which is also in unstable
> but
> not in the previous stable release).
> 
> Please find attached the debdiff vs the previous release without
> doc/html/* changes in the source archive which shrinks the diff down
> to
> 600KiB from 10MiB.

fwiw, even with the reduced diffs, neither request made it to debian-
release.

Were you anticipating that 0.103.4 would get published via -updates, or
simply with the next point releases?

Regards,

Adam