glsa says affected by older version not installed [SOLVED]

Message

stmiller · Post by **stmiller** » Tue Nov 19, 2013 12:29 am

My server says I am affected by a glsa from Oct 2013. However the package appears to be up to date. Have you ever run across this?

What am I doing wrong?

Code: Select all

stmiller@chicago ~ $ sudo glsa-check -t affected
Password: 
This system is affected by the following GLSAs:
201310-15
stmiller@chicago ~ $ emerge --ask --oneshot --verbose ">=sys-devel/automake-1.11.6" 
This action requires superuser access...
Would you like to add --pretend to options? [Yes/No] yes

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] sys-devel/automake-1.13.4:1.13  0 kB

Total: 1 package (1 reinstall), Size of downloads: 0 kB

 * IMPORTANT: 5 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.
^C

Code: Select all


stmiller@chicago ~ $ automake --version                                                     
automake (GNU automake) 1.13.4                                                              
Copyright (C) 2013 Free Software Foundation, Inc.                                           
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl-2.0.html>           
This is free software: you are free to change and redistribute it.                          
There is NO WARRANTY, to the extent permitted by law.                                       
                                                                                            
Written by Tom Tromey <tromey@redhat.com>                                                   
       and Alexandre Duret-Lutz <adl@gnu.org>.                                              
stmiller@chicago ~ $          


stmiller@chicago ~ $ sudo glsa-check --list affected
Password: 
[A] means this GLSA was marked as applied (injected),
[U] means the system is not affected and
[N] indicates that the system might be affected.

201310-15 [N] GNU Automake: Multiple vulnerabilities ( sys-devel/automake )
stmiller@chicago ~ $ sudo glsa-check --fix 201310-15
Fixing GLSA 201310-15
>>> cannot fix GLSA, no unaffected packages available

jburns · Post by **jburns** » Tue Nov 19, 2013 4:48 am

You can have more than one version of sys-devel/automake installed. Use eix to check for installed versions.

Code: Select all

eix-update
eix sys-devel/automake

stmiller · Post by **stmiller** » Tue Nov 19, 2013 2:05 pm

Thanks! Looks like I do have multiple versions installed somehow. I'll remove the vulnerable versions. Cheers,

Code: Select all

stmiller@chicago ~ $ sudo eix sys-devel/automake
[I] sys-devel/automake
     Available versions:  
     (1.4)  1.4_p6-r1
     (1.5)  1.5-r1
     (1.6)  1.6.3-r1
     (1.7)  1.7.9-r2
     (1.8)  1.8.5-r4
     (1.9)  1.9.6-r3
     (1.10) 1.10.3
     (1.11) 1.11.6
     (1.12) 1.12.6
     (1.13) ~1.13.1 ~1.13.2 ~1.13.3 1.13.4
     (1.14) ~1.14
     (9999) **9999
     Installed versions:  1.10.3(1.10)(02:03:19 06/23/13) 1.11.6(1.11)(13:21:26 06/23/13) 1.12.6(1.12)(01:52:50 06/23/13) 1.13.4(1.13)(23:59:53 11/10/13)
     Homepage:            http://www.gnu.org/software/automake/
     Description:         Used to generate Makefile.in from Makefile.am

[I] sys-devel/automake-wrapper
     Available versions:  3-r1 4 5 6 7 ~8 9
     Installed versions:  9(19:09:53 10/30/13)
     Homepage:            http://www.gentoo.org/
     Description:         wrapper for automake to manage multiple automake versions

Found 2 matches.
stmiller@chicago ~ $