bash-4.3-p46 -> bash-4.3-p48

[LnL7]

Motivation for this change

CVE-2016-9401 for #21642

• ~6958 rebuilds for x86_64-darwin
• ~12383 rebuilds for x86_64-linux

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

[mention-bot]

@LnL7, thanks for your PR! By analyzing the history of the files in this pull request, we identified @vcunat to be a potential reviewer.

[NeQuissimus]

Should we stage this first?

[vcunat]

I'm testing a bit locally first.

[LnL7]

I'm also building a bunch of stuff locally, since it's a pretty important package. Looks good so far.

[vcunat]

This is the one with big rebuild, but vulnerabilities seem aimed at interactive bash and we default to 4.4 for that, and that branch has no patches for these problems in the upstream list yet.

[LnL7]

I noticed 4.4, but as far as I can tell my system doesn't use that.

[vcunat]

On my nixos (no bash overrides):

$ bash --version
GNU bash, version 4.4.0(1)-release
...

[vcunat]

I hope this fixes all the currently known bash vulnerabilities.

[LnL7]

I think so, looks like it's only the default on master/unstable for bashInteractive. We might want to backport this then?

/cc @grahamc

[vcunat]

I'm slightly confused. Gentoo seems to have updated to the 4.3-p48 in October and now after several months they make a security alert...

[vcunat]

Oh, I looked wrong... the announcement is for 4.3-p48 -r1 vs. vanilla -p48 – they added more patches that haven't been published on the upstream patch list: https://security.gentoo.org/glsa/201701-02

[vcunat]

We can do it like Gentoo, adding their patch on top. They've deployed it so it's probably OK.

[vcunat]

Let me just do a bit more testing with that.

[grahamc]

Is this going to stable?

[LnL7]

master uses 4.4 for bashInteractive so this is not super important there, but 16.09 does use this version for everything.

[vcunat]

I'll do the picking.

[grahamc]

OK Sounds good to me. I wouldn't worry about using a staging branch for 16.09, can you update #21642 when you have?

[vcunat]

Oh, an equivalent of this PR was on 16.09 already: #19274 but we were missing these security patches on master :-/

[grahamc]

Well I'll be...

[vcunat]

I picked that new Gentoo patch at least: e924319, which is all that the current CVE message seems to be about.

[LnL7]

Thanks!