Federicoquattrin ~ubuntu-security membership application

Project Discussion Security
1

Verified identity

I’m a member of ~canonical-security, and my identity was verified when I joined canonical as an employee on 8 Apr 2024 and during the 24.04 sprint.

Security Updates

Please find below some of the security updates I did:

In addition, I opened and fixed these LP bugs in tomcat7:

I opened this bug in OpenJDK, which is related to the tomcat7 bug: Bug #2071855 “TLS_EMPTY_RENEGOTIATION_INFO_SCSV is disabled afte...” : Bugs : openjdk-7 package : Ubuntu

In the following table, you can see how they cover the various supported Ubuntu releases:

Ubuntu 14.04 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04 Ubuntu 22.04 Ubuntu 23.10 Ubuntu 24.04 Ubuntu 24.10
Cryptojs (universe) — esm esm archive esm — — —
Libspreadsheet-parse-excel (universe) esm esm esm archive archive — — —
Tpm2-tss (main) — — — archive archive archive archive See notes below (*)
Libphp-adodb (universe) — esm esm esm archive — — —
Tomcat7 (main only in trusty) esm esm esm — — — — —
Php-cas (universe) — esm — archive archive — — —
Ocsinventory-server (universe) — — — — archive — — —
Curl (main) esm esm esm — — — — —
Postgresql (main) — esm — — — — — —
Puma (universe) — — — esm esm — — —

(*) As recommended by a senior security team member, I contacted Gianfranco Costamagna through IRC since this person was the last one to merge tpm2-tss. I asked if they planned to upload a security update to oracular proposed.

Troubleshooting

While doing CVE patching, here are a few situations that I faced:

Tomcat7

While trying to patch tomcat7 for trusty, I found it was FTBFS in the test suite. After my research, I found out the reason for the failure was related to updates on the supported ciphers of OpenJDK since the last time the package was built. I opened these two LP bugs: Bug #2071856 “Tomcat7 fails to build from source due to the late...” : Bugs : tomcat7 package : Ubuntu (tomcat) and Bug #2071855 “TLS_EMPTY_RENEGOTIATION_INFO_SCSV is disabled afte...” : Bugs : openjdk-7 package : Ubuntu (OpenJDK) and fixed the FTBFS issue by adding the missing ciphers back to the test suite only.

Php-cas / Ocsinventory-server

The update that I worked on for this package was a collaboration with Debian (php-cas). While working on it, I found several issues that prevented the package from being successfully built or operating normally:

  • The version of ocsinventory-server for Jammy was incompatible with PHP 8.1, which we distribute in Jammy.
  • Although the backend feature for logging via CAS was present, the package was missing some features that enabled users to select it.
  • ocsinventory-server has a vendored php-cas version which should also be patched, and we were not tracking it.

I also found that Moodle (another source package not related to this collaboration) had a vendored version of php-cas so I updated the CVE to reflect that. See CVE-2022-39369 | Ubuntu. In addition, I created an MR to create a boilerplate for php-cas: https://code.launchpad.net/~federicoquattrin/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/470102.

Postgresql

While patching Postgresql, I found that the software FTBFS. After some research, we found that the root issue was that my system used a different locale than en_US. During build time, postgresql expects the system to have the en_US locale. To fix this issue, I had to jump into my schroot and execute “locale-gen en_US en_US.UTF-8 es_AR.UTF-8” and then “dpkg-reconfigure locales”.

Tools

I have demonstrated an understanding of QRT by creating the internal documentation and by opening the following MP that created new test suites for the packages:

I have gathered experience with UCT by assigning and updating CVEs as well as filling in missing package information in package_info_overrides.json. I also improved some of the checks that we have in place:

Assigned CVEs to me (limited to 5 out of 14):

Updated CVE data as a result of patching or triaging (limited to 5 out of 14):

Update package_info_overrides.json so that new USNs can leverage this information:

Improve scripts/tools:

I demonstrated an understanding of UST by putting in place some safeguards that will prevent us from doing work in unsupported packages:

Communications

I have signed and am following the Ubuntu Code of Conduct. As part of a collaboration with Debian for php-cas and ocsinventory-server, I interacted with Bastien Roucaries via email and shared the research results explained in the troubleshooting section.

I have also contacted upstream of wsdd as part of a MIR to discuss some package security topics.

5 Likes
2

As per [spec] ~ubuntu-security membership, +1 from me for @federicoquattrin to join ~ubuntu-security - he meets all the respective criteria and has made significant contributions to the security of Ubuntu.

3

As presented in the application above, @federicoquattrin has clearly met each requirement to join ~ubuntu-security and has done some excellent work with all contributions. Therefore, +1 from me.

4

@federicoquattrin has met all the criteria to join ~ubuntu-security and consistently produced outstanding work with each contribution. +1 from me!

5

+1 from me as well to support @federicoquattrin 's application to join ~ubuntu-security. The evidence provided is clear and covers they key aspects of this membership. Thanks for the amazing work Fede!

6

Federico already got the amount of votes needed, but I just wanted to give also my +1 as Fede’s contribution have been great and the criterias were met!

7

The evidence amply supports that @federicoquattrin meets all necessary criteria for membership.

They are a solid team member who wholly represent our values, earning my vote (+1).

8

+1 to add @federicoquattrin to ~ubuntu-security. Fede does quality work and is thorough. I appreciate that Fede is an excellent communicator (within the team and externally) and that he takes time to help others.

9

+1 for adding @federicoquattrin to ~ubuntu-security. His expertise to face difficult challenges and solve them are admirable. He matches all criterias to become a member.

10

Also +1 from me to add @federicoquattrin to the lp:ubuntu-security team.

11

+1 to add @federicoquattrin to ~ubuntu-security.
Thanks Fede for the awesome job.

12

Thank you @federicoquattrin for your application, and thank you to everyone who gave feedback on the application. Voting is now closed.

The following votes were cast by existing Ubuntu Security members:

The application is approved with a balance of 9 affirmative votes making up 100% of the total votes cast.

Congratulations and welcome Federico Quattrin! I have added you to the Ubuntu Security team, please exercise caution with your new rights.

Thanks,
Steve Beattie