[Debian-med-packaging] Bug#1152371: oscar: unregistered vendor copy of botan

[Helmut Grohne]

Source: oscar
Version: 1.7.1-1
Severity: serious
Justification: vendors unfixed botan vulnerabilities
Tags: security
Cc: debian-security at lists.debian.org

oscar builds a vendor copy of botan. This is problematic on several
levels. The Debian policy discourages embedded code copies and this
makes it a normal bug. A vulnerability in botan (which is a crypto
library after all) has to be fixed several times. Worse, one has to
figure out which packages include such a copy. Therefore, we keep a
record at
https://salsa.debian.org/security-tracker-team/security-tracker/-/blob/master/data/embedded-code-copies.
Notably, oscar is not listed here. The botan version included in oscar
is very old. It is very likely affected by a number of vulnerabilities
fixed in newer versions, see
https://security-tracker.debian.org/tracker/source-package/botan.
Beyond this, I attempted to cross build oscar and found that when
building it for s390x, it would fail with "error: writing 1 byte into a
region of size 0 [-Werror=stringop-overflow=]".  This likely is due to
compiling with -Werror and gcc-16 having gained precision in warnings
(or false positives). I cannot reproduce this on amd64.

This bug report is about the unregistered and vulnerable vendor copy.
Please decide whether oscar has a good reason to vendor botan. If it
does, register your vendor copy with the security tracker and fix all
vulnerabilities (e.g. by updating the copy) and close this bug. If it
does not, please reuse the system copy.

Helmut