add png vulnerability

[bhogan-mitre]

No description provided.

[glin]

@bhogan-mitre thanks! I saw there was some discussion in the png repo, is there anything left to do here or is this ready to go?

[bhogan-mitre]

@glin thanks for checking. This one is debatable. It seems that the only way to get a vulnerable version of libpng directly from the png package is on a version of R for Windows at least several years old. That possibility has been removed in the recently released R png version 0.1-9.

That said, even on R 4.5 a vulnerable version of libpng will still be used via Rtools. It's just not coming from the png package.

For reference, when I was checking png 0.1-8, I got libpng 1.5.60 when installing the package binary, and libpng 1.5.64 when installing from source.

Do you have thoughts on where vulnerabilities with Rtools should be tracked? I don't see an obvious github issues page to report those and I just emailed the maintainer of Rtools to report this one. Although it can impact several R packages that depend on Rtools, as well as the build process that prepares binary versions for CRAN.

[glin]

@bhogan-mitre Honestly, no idea and it's a hard question 🙂. We've talked about it before in an R Consortium working group meeting and didn't come up with any good answers.

Rtools is kind of weird, in that it's basically a software distribution on Windows that doesn't really use a package management system. You update by installing the latest installer exe, and previous installers are just deleted off of CRAN. The only easy way (?) to tell what's inside Rtools is to read through the NEWS doc, https://cran.r-project.org/bin/windows/Rtools/rtools45/news.html

I think it'd fit most appropriately as its own ecosystem, similar to a linux distro, but it's also very specific and tied into R and CRAN.

I don't know where Rtools vulnerabilities are tracked, but the news file will mention them when system libs are patched for some CVE.

A second complication is that OSV and this advisory database have no good way of capturing vulns in binary distributions of CRAN packages. Unlike a PyPI where the binaries and source code are all tied to the same published package version, you can get CRAN binaries for png from CRAN itself (windows/macos only), Posit Package Manager (e.g. https://p3m.dev), R-universe, and etc.

These png binaries may be using different Rtools versions or even a libpng from somewhere else. They might also get rebuilt with a different Rtools/libpng version over time, so png 0.1-9 today might have a vulnerable libpng, but might ship with a patched libpng tomorrow. And there's no easy way to tell apart two png package binaries because R doesn't have the binary-specific metadata for that. They both look like png 0.1-9.

If the underlying system lib isn't tied or bundled with the package itself, then it's real tricky to record a vulnerability for it.

For this png case where the fallback script could technically download a vulnerable libpng, it does make sense to record a vulnerability to me. But I'm curious if we could add more detail on when the fallback is triggered, e.g. what version of R or associated Rtools version that is.

If it's R 3.x, then I'm sure there are enough legacy 3.x uses out there that people would find this useful. If it's R 2.x from 15+ years ago though, then yeah, that's more debatable.

[bhogan-mitre]

Hi @glin, thanks for the info and your thoughts on this. I agree and I wish there was more transparency around what users get from Rtools, and a more clear process for reporting issues there.

Thanks for mentioning the working group. I'm guessing it's this one: r-repositories-wg
I'll sign up for that mailing list and look for future opportunities to get involved there.

On the png package, I believe I've narrowed down the issue to R versions < 4.2. I installed png 0.1-8 (prior to the recent fix) from source on a handful of Windows R versions. It looks like R >= 4.2 will get libpng from Rtools. Earlier versions of R will get vintage 2011 libpng downloaded as part of the png package installation.

R 3.6.3, libpng downloaded during png install

R 4.1.3, libpng downloaded during png install

R 4.2.3, libpng used from Rtools42

I'll update the PR to reflect the R versions where the download of a vulnerable libpng is applicable.

[bhogan-mitre]

I updated the summary and description here. Let me know if you think that language is okay with respect to Rtools. I'm open to suggestions there. Thanks @glin.

[glin]

@bhogan-mitre thanks, that looks good. R 4.1 is still commonly used and in many packages' (e.g. Tidyverse, Posit products) support windows, so I think this makes sense to add. And yes, that's repo for the Repositories working group.