diff -Nru software-properties-0.98.9/add-apt-repository software-properties-0.98.9.2/add-apt-repository --- software-properties-0.98.9/add-apt-repository 2020-04-16 08:41:28.000000000 +0000 +++ software-properties-0.98.9.2/add-apt-repository 2020-08-07 13:15:34.000000000 +0000 @@ -4,6 +4,7 @@ import io import os +import re import sys import gettext import locale @@ -146,7 +147,11 @@ print(e) sys.exit(1) - print(" %s" % (info["description"] or "")) + # strip ANSI escape sequences + description = re.sub(r"(\x9B|\x1B\[)[0-?]*[ -/]*[@-~]", + "", info["description"] or "") + + print(" %s" % description) print(_(" More info: %s") % str(info["web_link"])) if (sys.stdin.isatty() and not "FORCE_ADD_APT_REPOSITORY" in os.environ): diff -Nru software-properties-0.98.9/debian/changelog software-properties-0.98.9.2/debian/changelog --- software-properties-0.98.9/debian/changelog 2020-04-16 09:57:50.000000000 +0000 +++ software-properties-0.98.9.2/debian/changelog 2020-08-07 13:15:34.000000000 +0000 @@ -1,3 +1,19 @@ +software-properties (0.98.9.2) focal-security; urgency=medium + + * SECURITY UPDATE: malicious repo could send ANSI sequences to terminal + (LP: #1890286) + - add-apt-repository: strip ANSI sequences from the description. + - CVE-2020-15709 + + -- Marc Deslauriers Fri, 07 Aug 2020 09:15:34 -0400 + +software-properties (0.98.9.1) focal; urgency=medium + + * cloudarchive: Enable support for the Victoria Ubuntu Cloud Archive on + 20.04 (LP: #1882583). + + -- Corey Bryant Mon, 08 Jun 2020 16:46:09 -0400 + software-properties (0.98.9) focal; urgency=medium * softwareproperties/gtk/SoftwarePropertiesGtk.py: diff -Nru software-properties-0.98.9/softwareproperties/cloudarchive.py software-properties-0.98.9.2/softwareproperties/cloudarchive.py --- software-properties-0.98.9/softwareproperties/cloudarchive.py 2020-04-16 08:41:28.000000000 +0000 +++ software-properties-0.98.9.2/softwareproperties/cloudarchive.py 2020-06-08 20:46:09.000000000 +0000 @@ -45,6 +45,7 @@ 'stein': 'bionic', 'train': 'bionic', 'ussuri': 'bionic', + 'victoria': 'focal', } MIRROR = "http://ubuntu-cloud.archive.canonical.com/ubuntu" UCA = "Ubuntu Cloud Archive"