6

I created Zipios version 2.x in 2015 based on an existing library and inherited the old version (0.1.5) as a result...

In June 2019, I got an email from Mike Salvatore who reported having a problem with the library, generating a DoS. I don't really support 0.1.x... but Mike was kind enough to create a patch. I applied it and created a new version of the source tarball for download and posted everywhere about the issue and the availability of the patched version 0.1.7.

What are you expected to do with the older versions that have that one bug in them?

I can't add a note directly in the old versions since the tarballs, the CVS, all of those things are expected to all be frozen (read-only.)

So I posted notes about the corresponding CVE-2019-13543 on all the attached websites.

Would you do more? Sourceforge.net lets me delete the old .tar.gz files, for example. I can also rename the folders (so instead of 0.1.5, I could have 0.1.5-with-DoS or something of the sort.) The one place where I've seen people dealing with such issues is Drupal and they hide versions that have security issues, but they remain available for download. You have to know your way to those files, though, they are somewhat hidden. So it seems to me that just leaving everything else the way it is would be the normal solution for such. Is that correct?

Improve this question
3
  • 2
    Are there websites you don't control that only have the old version? Or are you asking if there are any better ways to alert users of the old version? Because it sounds like you've already done an excellent job at handling this issue.
    – curiousdannii
    Commented Jul 13, 2019 at 13:46
  • 2
    If everyone deleted old versions of things that had security issues, we would probably have to delete every old version of everything, and possibly the newest versions as well. I think people understand that if it is an old version, there are risks.
    – Brandin
    Commented Jul 13, 2019 at 17:30
  • @curiousdannii, I am not really aware of any major website that would talk about this library... So I would think that I'm pretty much done on the matter. Good good.
    – Alexis Wilke
    Commented Jul 14, 2019 at 2:39

2 Answers 2

Reset to default
6

What are you expected to do with the older versions...?

That is something that is decided by every project maintainer. Some projects will only provide support and updates for the latest release, others may also provide updates for several past releases.

You have provided an update and documented a known issue, even for an old version released before you started your fork of the project. I would say you have done more than what is expected of you. It is now up to the users to update what they have installed.

If the issue is of big enough scope, then taking steps to hinder acquiring older versions of the code will help to prevent additional vulnerable installations and encourage packaging systems to be updated. That is the most you can be expected to do.

Improve this answer
1

Are there rules on what to do with an old OpenSource software with a security issue?

No

First I don't see that this is related to OpenSource, as there is nothing in the definition about this. You and everyone else is free to delete any open source executable software. But you may have to keep source code.

Second if you are the maintainer you are not bound by the licence, so can even delete source code. However I would just label and hide source code, and remove executable version.

Yes

There may be laws stating that you have to make some effort to protect your users (this will vary by legal system).

Improve this answer
2
  • Oh? Do you have an example of a law that protects users from security issues? I've not heard of that one before...
    – Alexis Wilke
    Commented Jul 15, 2019 at 10:21
  • 1
    @AlexisWilke I bet you don't even know ALL the laws in your own country. I would even bet that you can not find someone that does. Some where in the world there will be a law. In the UK it may be covered by the computer miss use act. Because OP will be distributing software that they know is malicious (generates a DOS).
    – ctrl-alt-delor
    Commented Jul 15, 2019 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.