Bug#1016973: kopanocore: CVE-2022-26562

2022-08-12 Thread Andreas Rönnquist
On Thu, 11 Aug 2022 20:57:57 +0200 Salvatore Bonaccorso wrote: > Hi Andreas, > > Can you get in contact with upstream about it? > Done (by mail) - I'll get back here when I get I reply. -- Andreas Rönnquist gus...@debian.org

Bug#1016973: kopanocore: CVE-2022-26562

2022-08-11 Thread Salvatore Bonaccorso
Hi Andreas, On Thu, Aug 11, 2022 at 04:45:06PM +0200, Andreas Rönnquist wrote: > To me it looks like the pam authenticator check miss a check with > pam_acct_mgmt in addition to the pam_authenticate that is already > there, see the attached patch. > > myproxy has similar code, and does a similar

Bug#1016973: kopanocore: CVE-2022-26562

2022-08-11 Thread Andreas Rönnquist
To me it looks like the pam authenticator check miss a check with pam_acct_mgmt in addition to the pam_authenticate that is already there, see the attached patch. myproxy has similar code, and does a similar thing here: https://sources.debian.org/src/myproxy/6.2.14-2/auth_pam.c/?hl=227#L227 (It

Bug#1016973: kopanocore: CVE-2022-26562

2022-08-10 Thread Moritz Mühlenhoff
Source: kopanocore X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for kopanocore. CVE-2022-26562[0]: | An issue in provider/libserver/ECKrbAuth.cpp of Kopano-Core v11.0.2.51 | contains an issue which allows attackers to