Bug#1043161: i2p: CVE-2023-36325

[Pierre Gruet]

Hi again,




Best,

--
Pierre

Le 10/11/2023 à 10:05, Pierre Gruet a écrit :

Just for the sake of clarity: below I suggested a path to removal but I want to make it clear I don't intend to undertake such action, disrespecting the maintainer. Debian processes have to be respected.

Hi Salvatore,




 > Source: i2p
 > Version: 0.9.48-1.1
 > Tags: security upstream
 > Justification: user security hole

 >
 > Hi,
 >
 > The following vulnerability was published for i2p.
 >
 > CVE-2023-36325[0]:
 > | Attackers can de-anonymize i2p hidden services with a message replay
 > | attack
 >
 > Should i2p be removed from unstable?


- i2p has not been in a Debian release since buster;
- its popcon is quickly decreasing;




What do you think?

 >
 > If you fix the vulnerability please also make sure to include the
 > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
 >
 > For further information see:
 >
 > [0] https://security-tracker.debian.org/tracker/CVE-2023-36325
 > https://www.cve.org/CVERecord?id=CVE-2023-36325
 > [1] https://xeiaso.net/blog/CVE-2023-36325
 >
 > Regards,
 > Salvatore
 >
 >

Best,

I am doing some QA overseeeing, I am not the maintainer of i2p. I NMUed it one year and a half ago, nothing has happened since then. On Sun, 06 Aug 2023 21:26:51 +0200 Salvatore Bonaccorso <car...@debian.org> wrote: > X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> - I feel fixing the CVE would require packaging last upstream version (which fixed it), Debian version is far behind it, upstream has changed its build system so a simple NMU is not the solution; - I don't feel the maintainer still has interest into this package, which he has not touched for 3 years; - There is another RC bug #1031817 needing being worked on, upstream has not addressed it yet; - there is only one rdep, syndie, with the same maintainer, it has not seen an upload in 4 years and has a near-zero popcon. I would indeed suggest removing the package and syndie (RoQA) after letting some time to the maintainer to respond. Keeping these two packages in unstable seems only harmful right now.

OpenPGP_signature.asc
Description: OpenPGP digital signature