BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

rambox: unmaintain & mark as insecure

Browse source 
Rambox hasn't had a stable release in a while and an increasing number
of issues which is why I don't intend to use this anymore.

While taking a closer look at the source I also realized that it uses
Electron 7.2.4[1]. This is not only EOLed[2], it also contains a few
security vulnerabilities which is why I decided to mark it as insecure.

A few (most likely not all) vulnerabilities can be found by looking at
the Electron 7 changelog[3]: after 7.2.4 there were a few more releases
with security backports - mostly from Chromium. Security issues that
were found later on (and are probably exploitable on the dependency
chain of rambox) aren't listed here. I only added two issues that seemed
applicable to `rambox`, but I haven't researched enough to check the
other ones.

[1] https://github.com/ramboxapp/community-edition/blob/0.7.7/package.json#L70
[2] https://www.electronjs.org/docs/tutorial/support#currently-supported-versions
[3] https://www.electronjs.org/releases/stable?version=7
This commit is contained in:
Maximilian Bosch 2021-06-04 22:31:13 +02:00
parent 6f1857f2f2
commit e2a15cd395
No known key found for this signature in database
GPG key ID: 091DBF4D1FC46B8E
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pkgs/applications/networking/instant-messengers/rambox/default.nix
View file

@ -21,8 +21,11 @@ in mkRambox rec {
description = "Free and Open Source messaging and emailing app that combines common web applications into one";
homepage = "https://rambox.pro";
license = licenses.mit;
maintainers = with maintainers; [ ma27 ];
maintainers = with maintainers; [ ];
platforms = ["i686-linux" "x86_64-linux"];
hydraPlatforms = [];
knownVulnerabilities = [
"Electron 7.2.4 is EOL and contains at least the following vulnerabilities: CVE-2020-6458, CVE-2020-6460 and more (https://www.electronjs.org/releases/stable?version=7). Consider using an alternative such as `ferdi'."
];
};
}