Repository navigation
Security: please update cfitsio #7272
Description
A new version of cfitsio just came out, accompanied with the following notice from upstream:
The NASA security team requires the following warning to all users of CFITSIO:
The CFITSIO open source software project contains vulnerabilities that could allow a remote, unauthenticated attacker to take control of a server running the CFITSIO software. These vulnerabilities affect all servers and products running the CFITSIO software.
The CFITSIO team has released software updates to address these vulnerabilities. There are no workarounds to address these vulnerabilities. In all cases, the CFITSIO team is recommending an immediate update to resolve the issues.
It is still unclear what the exact problem is (see discussion in Debian bug #892458), but it may be wise to update cfitsio in 3.X and 2.X and to create a new point release.
Activity
MSeifert04 commentedon Mar 9, 2018
If I remember correctly @mhvk did the last cfitsio update. Could you check if it's easy for you (you did have some scripts?) to do another update?
MSeifert04 commentedon Mar 9, 2018
Ups, I fat-fingered the "close and comment" button there. Sorry.
drdavella commentedon Mar 9, 2018
@MSeifert04 I was starting to look into this and was operating under the assumption that I could just drop the new files into place. Maybe it's not that easy, though?
MSeifert04 commentedon Mar 9, 2018
I don't remember exactly, you could have a look at #6477
drdavella commentedon Mar 9, 2018
Will do, thanks.
MSeifert04 commentedon Mar 9, 2018
FWIW: https://github.com/astropy/astropy/blob/master/cextern/trim_cfitsio.sh seems to be the relevant script...
drdavella commentedon Mar 9, 2018
Yes, I just noticed that as well, thanks 👍
eteq commentedon Mar 9, 2018
The releasing team agrees this justifies a new point release for both branches ASAP after the bug fixes are merged. Thanks for the quick action here, all!
eteq commentedon Mar 9, 2018
I'm re-opening this because I think we should keep this open until a bugfix release has happened with both of these.
bsipocz commentedon Mar 12, 2018
I'm in the middle of the release process for both releases, so closing this now to clear the milestone.
2scopes commentedon Apr 13, 2018
Due to the release yesterday of CFITSIO 3.44, which also patched critical bug fixes I suggest either a new issue, or to reopen this one until this version is applied.
https://heasarc.gsfc.nasa.gov/docs/software/fitsio/fitsio.html