Your message dated Wed, 18 Jan 2017 16:34:04 +0000
with message-id <[email protected]>
and subject line Bug#833885: fixed in gbrowse 2.56+dfsg-1
has caused the Debian Bug report #833885,
regarding gbrowse: ships a deterministic/predictable OpenID consumer secret
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
833885: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833885
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gbrowse
Version: 2.54+dfsg-7
Severity: normal
Tags: security
User: [email protected]
Usertags: randomness
X-Debbugs-Cc: [email protected]
Hi,
gbrowse ships an OpenID consumer secret in
/usr/share/perl5/GBrowse/ConfigData.pm:
{
'OpenIDConsumerSecret' => '639098210478536',
'cgibin' => '/usr/lib/cgi-bin/gbrowse',
'conf' => '/etc/gbrowse',
'config_done' => 1,
'databases' => '/var/lib/gbrowse/databases',
'htdocs' => '/usr/share/gbrowse/htdocs',
'installetc' => 'y',
'persistent' => '/var/lib/gbrowse',
'registration_done' => '1',
'tmp' => '/var/cache/gbrowse'
},
The number is randomly generated a build-time, meaning that everyone installing
that particular .deb gets the same "secret". The security implications of this
should be obvious, hence the tag.
(In addition, it also means the package is not reproducible.)
Regards,
--
,''`.
: :' : Chris Lamb
`. `'` [email protected] / chris-lamb.co.uk
`-
--- End Message ---
--- Begin Message ---
Source: gbrowse
Source-Version: 2.56+dfsg-1
We believe that the bug you reported is fixed in the latest version of
gbrowse, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Tille <[email protected]> (supplier of updated gbrowse package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 18 Jan 2017 17:16:19 +0100
Source: gbrowse
Binary: gbrowse gbrowse-data gbrowse-calign
Architecture: source amd64 all
Version: 2.56+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Med Packaging Team
<[email protected]>
Changed-By: Andreas Tille <[email protected]>
Description:
gbrowse - GMOD Generic Genome Browser
gbrowse-calign - CAlign helper
gbrowse-data - Sample data to use GBrowse
Closes: 826458 833885 848236
Changes:
gbrowse (2.56+dfsg-1) unstable; urgency=medium
.
[ Olivier Sallou ]
* Fix deprecated unescaped left brace in regex
Closes: #826458
.
[ Andreas Tille ]
* New upstream version
Closes: #848236
* Symlink OpenID constumer secret to /etc/gbrowse/ConfigData.pm
and document this in README.Debian
Closes: #833885
* debhelper 10
* d/watch: version=4
* Exclude some tests via debian/tests/pkg-perl/smoke-skip
* Add missing Build-Depends: libbio-graphics-perl, libbio-coordinate-perl
* Enhance descriptions
* hardening=+all
* Remove unused lintian override
* Add $remote_fs to required-start
* Add missing Depends: lsb-base (>= 3.0-6)
* Fix runlevel of initscript
* Fix manpage synopsises and spelling
* Init lsb functions in all init scripts
* Add missing "update-rc.d gbrowse-aws-balancer" calls
Checksums-Sha1:
22501e2a43df3dacafaa3f948ef6d7054d3caf69 2641 gbrowse_2.56+dfsg-1.dsc
269fba6b75112b0a2037350308914f05d4747697 4355977 gbrowse_2.56+dfsg.orig.tar.gz
7e59e2a3845af9e05428c21295f5608dd14c8e83 22284
gbrowse_2.56+dfsg-1.debian.tar.xz
2a079697dfab0a1d8775cbd7ef300decb29250bd 27932
gbrowse-calign-dbgsym_2.56+dfsg-1_amd64.deb
62b246fb48e723e48c8b08f9ef1b890a8920a2e7 35794
gbrowse-calign_2.56+dfsg-1_amd64.deb
9b71506aacaff0080b4b367389f26fe3111c651b 1234536
gbrowse-data_2.56+dfsg-1_all.deb
dd8457a4a82e6cd0eee47863aef51f6657dd67ed 2376460 gbrowse_2.56+dfsg-1_all.deb
3933e56299ffbea133aeb1636ec5e26cec8a3a33 8349
gbrowse_2.56+dfsg-1_amd64.buildinfo
Checksums-Sha256:
248ff3221d27950baa8cebe5bdf5f27b941de0162d75f70e6ed9c8696f9f5136 2641
gbrowse_2.56+dfsg-1.dsc
f6da1ff315b17ec260810cf439a54ae7ddd66728015be03f7fbb6ba795676f81 4355977
gbrowse_2.56+dfsg.orig.tar.gz
6bb109a315a8c998aea87b41b58247dc41f855a43f2faca0538851cb7a651b45 22284
gbrowse_2.56+dfsg-1.debian.tar.xz
fc6949cb40e7b4b2cbb9d969feda0e285ac4f7f06c3ddad6560878cfde203f5e 27932
gbrowse-calign-dbgsym_2.56+dfsg-1_amd64.deb
8d4311b886643ff8f02e51514984f4e7fd467438830b94e3cee6e505f63311bd 35794
gbrowse-calign_2.56+dfsg-1_amd64.deb
ad4fa399e6c9e271ccc3aa648f30908d0afbfc01f43925b264107d8b9254514d 1234536
gbrowse-data_2.56+dfsg-1_all.deb
0c35efefd08ef8f24c00dde5999354bd34f5ce1acf6b5873829e58bc7363fcaa 2376460
gbrowse_2.56+dfsg-1_all.deb
a098fa0ef76022ab49afc43ba5159d3b3036c265eec685816d1be4b1ef76d421 8349
gbrowse_2.56+dfsg-1_amd64.buildinfo
Files:
389aa71b47fccb7a51069d4655a5bf5c 2641 science optional gbrowse_2.56+dfsg-1.dsc
9638dd3e43897548172911706277f177 4355977 science optional
gbrowse_2.56+dfsg.orig.tar.gz
66459ba99292df4f861f9e0354bfa9d6 22284 science optional
gbrowse_2.56+dfsg-1.debian.tar.xz
9a13b1a1c180467561c7cdfb65c81eda 27932 debug extra
gbrowse-calign-dbgsym_2.56+dfsg-1_amd64.deb
119584e9543decac6e5b202c6edeaf64 35794 science optional
gbrowse-calign_2.56+dfsg-1_amd64.deb
bbb037cda01422da94524072774b4bf1 1234536 science optional
gbrowse-data_2.56+dfsg-1_all.deb
821faded43382c17c3ea79a179a71967 2376460 science optional
gbrowse_2.56+dfsg-1_all.deb
f2082fd5e24a4dc80737a6ed31e33edf 8349 science optional
gbrowse_2.56+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJYf5YSAAoJEFeKBJTRxkbRA2EP/3h6IqKnUMK7lsRcQNHjPLxX
FLUbJzjIV/AN+WnooRS69m/Vg8F4MRIRVdaaZCcXeH4qxp7FkMxtFbCiNpsGAgSF
DNKOyMfdcSn2zEmR53tQu7sgjZMrGfA4JN/TYiOIT0ZMXwmgHRpYC3mZaVzmJcEh
PMzcam4X+hSljNNRuYujg2y69K509DFJnVR032PgoxDhCgdGrv5LwzvgcebXZyJZ
BCiM0xij+/+gY0DzeqHHrlVvu22WWTsVYgVPuRN7LlwiaYxawpftZijeuUN6/5Iy
Rsvl8SWeFRq67jRqkxxNFDUb2KYeaALYAEokctYYx/Y1DC/44WC3XYSKLkRu/VdP
xvp4b740JzvBcO/392WB3ZpGGAbLnIz+xLvKxKY/TngPhVK50+reSRN6qrjII8Ep
BY4XRJrmGYpEGvOqXarSTt1jtGtq/93OkgJjhLBAXrF43YD2lHjnVFWBVI2kDT1H
CsfNcxO6T3d3XAAHWSatQg8UbdBrWBqcFWZNnriX1n3fkEsgIDCfbesCfU6WvZNV
PDNP2MdBfr8rQxE0pnuKGrnC9u+P4cfLPC//jRS5gKOenewAxehHeDRRbaSpSZxN
6oBbBXiMrHXEfIe0CteMiBd1929JBcBQPiEWMaZlneH9uJdA6yMbRtlmh2PLi0Uw
ugkl1En60wzGO8FO1jJO
=hkWu
-----END PGP SIGNATURE-----
--- End Message ---
