public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rambox: unmaintain & mark as insecure

Browse Source 
Rambox hasn't had a stable release in a while and an increasing number
of issues which is why I don't intend to use this anymore.

While taking a closer look at the source I also realized that it uses
Electron 7.2.4[1]. This is not only EOLed[2], it also contains a few
security vulnerabilities which is why I decided to mark it as insecure.

A few (most likely not all) vulnerabilities can be found by looking at
the Electron 7 changelog[3]: after 7.2.4 there were a few more releases
with security backports - mostly from Chromium. Security issues that
were found later on (and are probably exploitable on the dependency
chain of rambox) aren't listed here. I only added two issues that seemed
applicable to `rambox`, but I haven't researched enough to check the
other ones.

[1] https://github.com/ramboxapp/community-edition/blob/0.7.7/package.json#L70
[2] https://www.electronjs.org/docs/tutorial/support#currently-supported-versions
[3] https://www.electronjs.org/releases/stable?version=7

(cherry picked from commit e2a15cd395f1e137c680d22f83cd195caf3d6c14)
This commit is contained in:
Maximilian Bosch 2021-06-04 22:31:13 +02:00 committed by github-actions[bot]
parent 527c0bbf84
commit ef186b47af
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkgs/applications/networking/instant-messengers/rambox/default.nix
View File

@ -21,8 +21,11 @@ in mkRambox rec {
description = "Free and Open Source messaging and emailing app that combines common web applications into one"; description = "Free and Open Source messaging and emailing app that combines common web applications into one";
homepage = "https://rambox.pro"; homepage = "https://rambox.pro";
license = licenses.mit; license = licenses.mit;
maintainers = with maintainers; [ ma27 ]; maintainers = with maintainers; [ ];
platforms = ["i686-linux" "x86_64-linux"]; platforms = ["i686-linux" "x86_64-linux"];
hydraPlatforms = []; hydraPlatforms = [];
knownVulnerabilities = [
"Electron 7.2.4 is EOL and contains at least the following vulnerabilities: CVE-2020-6458, CVE-2020-6460 and more (https://www.electronjs.org/releases/stable?version=7). Consider using an alternative such as `ferdi'."
];
}; };
} }