[gentoo-dev] [RFC] A new GLSA schema

[John Helmert III]

The first GLSA in glsa.git is GLSA-200310-03, the third GLSA of
October 2003. It used roughly the same format of the GLSAs we release
today, in 2022, making that format almost as old as me.

Somewhere along the way, it started to become necessary to target
multiple version ranges within the same package. The GLSA format
isn't capable of expressing this. Thus, I propose a new format (an
example of which I've attached inline below), with the following
changes from the old format:

 - Rework affected to use XML-ified logical operators to specify the
   affected versions, and *don't* use different fields to specify
   vulnerable and unaffected versions. Instead, only list vulnerable
   versions, unaffected versions are implicit.

 - Drop synopsis and description fields. These fields contain the same
   information and will be superceded by the existing impact field.

 - Drop background field. This is usually just the package's
   description, or some similar text. No reason to reproduce it in
   GLSAs.

What does everyone think?

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "https://www.gentoo.org/dtd/glsa-2.dtd">
<glsa id="202213-00">
  <title>Nvidia Drivers: Multiple Vulnerabilities</title>
  <announced>2022-13-00</announced>
  <revised count="1">2022-13-00</revised>
  <bug>764512</bug>
  <bug>784596</bug>
  <bug>803389</bug>
  <bug>832867</bug>
  <bug>845063</bug>
  <bug>866527</bug>
  <affected>
    <any>
      <and>
        <constraint op="ge" atom="x11-drivers/nvidia-drivers-390"/>
        <constraint op="lt" atom="x11-drivers/nvidia-drivers-390.154"/>
      </and>
      <and>
        <constraint op="ge" atom="x11-drivers/nvidia-drivers-470"/>
        <constraint op="lt" atom="x11-drivers/nvidia-drivers-470.141.03"/>
      </and>
      <and>
        <constraint op="ge" atom="x11-drivers/nvidia-drivers-510.85"/>
        <constraint op="lt" atom="x11-drivers/nvidia-drivers-510.85.02"/>
      </and>
      <and>
        <constraint op="ge" atom="x11-drivers/nvidia-drivers-515.65"/>
        <constraint op="lt" atom="x11-drivers/nvidia-drivers-515.65.01"/>
      </and>
    </any>
  </affected>
  <impact type="high">
    <p>These vulnerabilities could allow a local user with low privileges to gain root privileges.</p>
  </impact>
  <workaround>
    <p>There is no known workaround at this time.</p>
  </workaround>
  <resolution>
    <p>All Nvidia drivers 390 users should upgrade to the latest version:</p>

    <code>
      # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-390.154"
    </code>

    <p>All Nvidia drivers 470 users should upgrade to the latest version:</p>

    <code>
      # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-470.141.03"
    </code>

    <p>All Nvidia drivers 510 users should upgrade to the latest version:</p>

    <code>
      # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-510.85.02"
    </code>

    <p>All Nvidia drivers 515.65.01 users should upgrade to the latest version:</p>

    <code>
      # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-515.65.01"
    </code>
  </resolution>
  <references>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1052">CVE-2021-1052</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1053">CVE-2021-1053</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1056">CVE-2021-1056</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE‑2021‑1076">CVE‑2021‑1076</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE‑2021‑1077">CVE‑2021‑1077</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1090">CVE-2021-1090</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1093">CVE-2021-1093</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1094">CVE-2021-1094</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-1095">CVE-2021-1095</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE‑2022‑21813">CVE‑2022‑21813</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE‑2022‑21814">CVE‑2022‑21814</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28181">CVE-2022-28181</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28183">CVE-2022-28183</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28184">CVE-2022-28184</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-28185">CVE-2022-28185</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-31607">CVE-2022-31607</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-31608">CVE-2022-31608</uri>
    <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-31615">CVE-2022-31615</uri>
  </references>
  <metadata tag="requester" timestamp="2022-09-28T14:25:19.979184Z">larry</metadata>
  <metadata tag="reviewer" timestamp="2022-09-29T14:25:19.979184Z">notlarry</metadata>
  <metadata tag="submitter" timestamp="2022-09-30T14:25:19.985055Z">larry</metadata>
</glsa>