Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Jeff McKenna
On 2022-04-07 11:07 a.m., Andrew C Aitchison wrote: On Thu, 7 Apr 2022, Greg Troxel wrote: Even Rouault writes: Most GDAL binary distributions don't use that internal copy but the external zlib library provided by the operating system / distribution channel. I realize you are accomodating

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Jeff McKenna
Thank-you Greg, this is exactly my earlier comment directly on the associated ticket this morning, but you explain it much better: https://github.com/OSGeo/gdal/issues/5587 It has caused so much grief downstream (zlib inside GDAL), that I believe it is time to remove it. -jeff On 2022-0

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Andrew C Aitchison
On Thu, 7 Apr 2022, Greg Troxel wrote: Even Rouault writes: Most GDAL binary distributions don't use that internal copy but the external zlib library provided by the operating system / distribution channel. I realize you are accomodating people who can somehow get and build gdal sources bu

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Mateusz Loskot
On Thu, 7 Apr 2022 at 15:08, Greg Troxel wrote: > Even Rouault writes: > I therefore think it would be good to consider removing the vendored > copies, or at least requiring explicit config to turn them on. +1 > I wonder if it's still really necessary/helpful to have included libs > like zlib.

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Greg Troxel
Even Rouault writes: > Most GDAL binary distributions don't use that internal copy but the > external zlib library provided by the operating system / distribution > channel. I realize you are accomodating people who can somehow get and build gdal sources but can't first install zlib, but from t

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Even Rouault
Internal zlib copy in GDAL master will be updated to 1.2.12 per https://github.com/OSGeo/gdal/pull/5588 Most GDAL binary distributions don't use that internal copy but the external zlib library provided by the operating system / distribution channel. Le 07/04/2022 à 12:24, prashanti seri a é

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Mateusz Loskot
On Thu, 7 Apr 2022 at 13:54, Andrew C Aitchison wrote: > On Thu, 7 Apr 2022, Mateusz Loskot wrote: > > On Thu, 7 Apr 2022 at 12:29, prashanti seri > > wrote: > >> Does zlib vulnerability CVE-2018-25032 affect GDAL as it uses this lib? > > > > Hints: > > https://github.com/OSGeo/gdal/blob/master

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Andrew C Aitchison
On Thu, 7 Apr 2022, Mateusz Loskot wrote: On Thu, 7 Apr 2022 at 12:29, prashanti seri wrote: Does zlib vulnerability CVE-2018-25032 affect GDAL as it uses this lib? Hints: https://github.com/OSGeo/gdal/blob/master/frmts/zlib/zlib.h#L40 https://github.com/OSGeo/gdal/blob/patch/3.2.2.1/gdal/f

Re: [gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread Mateusz Loskot
On Thu, 7 Apr 2022 at 12:29, prashanti seri wrote: > Does zlib vulnerability CVE-2018-25032 affect GDAL as it uses this lib? Hints: https://github.com/OSGeo/gdal/blob/master/frmts/zlib/zlib.h#L40 https://github.com/OSGeo/gdal/blob/patch/3.2.2.1/gdal/frmts/zlib/zlib.h#L40 https://github.com/OSGeo

[gdal-dev] zlib vulnerability CVE-2018-25032 affecting GAL

2022-04-07 Thread prashanti seri
Hi, Does zlib vulnerability CVE-2018-25032 affect GDAL as it uses this lib? any update on this? Thanks Prashanti ___ gdal-dev mailing list gdal-dev@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/gdal-dev