Your message dated Mon, 05 Jun 2017 12:49:00 +0000
with message-id <[email protected]>
and subject line Bug#862053: fixed in wordpress 4.7.5+dfsg-2
has caused the Debian Bug report #862053,
regarding wordpress: CVE-2017-8295
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
862053: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862053
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wordpress
X-Debbugs-CC: [email protected]
[email protected]
Severity: important
Tags: security
Hi,
the following vulnerability was published for wordpress.
CVE-2017-8295[0]:
| WordPress through 4.7.4 relies on the Host HTTP header for a
| password-reset e-mail message, which makes it easier for remote
| attackers to reset arbitrary passwords by making a crafted
| wp-login.php?action=lostpassword request and then arranging for this
| message to bounce or be resent, leading to transmission of the reset
| key to a mailbox on an attacker-controlled SMTP server. This is
| related to problematic use of the SERVER_NAME variable in
| wp-includes/pluggable.php in conjunction with the PHP mail function.
| Exploitation is not achievable in all cases because it requires at
| least one of the following: (1) the attacker can prevent the victim
| from receiving any e-mail messages for an extended period of time
| (such as 5 days), (2) the victim's e-mail system sends an autoresponse
| containing the original message, or (3) the victim manually composes a
| reply containing the original message.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
No official patch has been published yet but there is an interesting assessment
at
http://blog.dewhurstsecurity.com/2017/05/04/exploitbox-wordpress-security-advisories.html
I think it makes sense to wait for an official Wordpress response but we could
also
try to avoid the SERVER_NAME variable in this case.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-8295
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8295
Please adjust the affected versions in the BTS as needed.
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 4.7.5+dfsg-2
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 05 Jun 2017 21:45:59 +1000
Source: wordpress
Binary: wordpress wordpress-l10n wordpress-theme-twentysixteen
wordpress-theme-twentyfifteen wordpress-theme-twentyseventeen
Architecture: source all
Version: 4.7.5+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Description:
wordpress - weblog manager
wordpress-l10n - weblog manager - language files
wordpress-theme-twentyfifteen - weblog manager - twentytfifteen theme files
wordpress-theme-twentyseventeen - weblog manager - twentyseventeen theme files
wordpress-theme-twentysixteen - weblog manager - twentysixteen theme files
Closes: 862053
Changes:
wordpress (4.7.5+dfsg-2) unstable; urgency=medium
.
* Don't trust SERVER_NAME variable for emails
CVE-2017-8295 Closes: #862053
Checksums-Sha1:
d8de2d922cfa7789ae34925d5fd05f7a8e037bb0 2539 wordpress_4.7.5+dfsg-2.dsc
b5fdc95e1497151b6c93172fb6535c98dc2e8ca9 6777644
wordpress_4.7.5+dfsg-2.debian.tar.xz
7cd070fed80da6cf951f8a406f48749a5635499d 4383124
wordpress-l10n_4.7.5+dfsg-2_all.deb
2d5c70ce578b4d04a97ea6727ed171917dcd12b9 700120
wordpress-theme-twentyfifteen_4.7.5+dfsg-2_all.deb
c876caa73f5677c526197a2c79c4fed0d0dc259a 939838
wordpress-theme-twentyseventeen_4.7.5+dfsg-2_all.deb
ca310d7f6dd72d5ffd9e7cb88778011c584a0f2d 588818
wordpress-theme-twentysixteen_4.7.5+dfsg-2_all.deb
0688cb11bb331dee53c95cde0dd6a96f5b7edcdd 3998900 wordpress_4.7.5+dfsg-2_all.deb
7ff9358352fb6c04d93179e7642a77765f4df768 7178
wordpress_4.7.5+dfsg-2_amd64.buildinfo
Checksums-Sha256:
8acc3c8a307d7159f1fc1f76dcfe0c58c77a19c2a08a9d2404b46f85ca6bf3bc 2539
wordpress_4.7.5+dfsg-2.dsc
96d62a9c178a18a6139ffc3ab2fe1d4f1c2f217509d8d32e38af1582135fb942 6777644
wordpress_4.7.5+dfsg-2.debian.tar.xz
3580f9ea9c869790cb03a4578085f5b3697d9ace158914677a4a36b209d6e172 4383124
wordpress-l10n_4.7.5+dfsg-2_all.deb
72023267b6b56bf8a54aa6587dc5d081167fbf82b395dee6c19ba5600dad3083 700120
wordpress-theme-twentyfifteen_4.7.5+dfsg-2_all.deb
d1256c327e1b7d2af3c64fb6113fbc5529a895a39839e9532db98d60fecd6a5b 939838
wordpress-theme-twentyseventeen_4.7.5+dfsg-2_all.deb
561692740003099d58cec50b4b2d72a3c175fb00855cdde7aa46aec7781a9bbe 588818
wordpress-theme-twentysixteen_4.7.5+dfsg-2_all.deb
9e983533d134eb9718d4fedf28212d4ae0c33c5868b2719ac876d6b9a4028d45 3998900
wordpress_4.7.5+dfsg-2_all.deb
ba5abd8684f7bd148d3620635a0071d8620578e38a3479fd482fbc1bb200df93 7178
wordpress_4.7.5+dfsg-2_amd64.buildinfo
Files:
7bddc38f8b6c0e7c60c561d1f36f4fa4 2539 web optional wordpress_4.7.5+dfsg-2.dsc
5918910abbb8062d732224e6356212db 6777644 web optional
wordpress_4.7.5+dfsg-2.debian.tar.xz
2e5c491d679fdf5c6d9d5b19af1d7b42 4383124 localization optional
wordpress-l10n_4.7.5+dfsg-2_all.deb
51e44eab3b57c1cd0724a7692034bea6 700120 web optional
wordpress-theme-twentyfifteen_4.7.5+dfsg-2_all.deb
15fb8502d011e2a99ff2782c968ab547 939838 web optional
wordpress-theme-twentyseventeen_4.7.5+dfsg-2_all.deb
d2cb7885566660c1534603dc473219a3 588818 web optional
wordpress-theme-twentysixteen_4.7.5+dfsg-2_all.deb
48033a59af30c4c7f9ef606a78a8f400 3998900 web optional
wordpress_4.7.5+dfsg-2_all.deb
813ee7102bf7ec9264c38887ef57d2da 7178 web optional
wordpress_4.7.5+dfsg-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAlk1SKwACgkQAiFmwP88
hOPwOQ//UCDEsrYDFdGJq4kaCYmOvtGozKXAZC1QyOfs4bsVXcEO4Uk3+pkPBl3Q
Vger4a31L5PvVaV/YpmAgwL719Vf4McdVHpADzMlnSz5vgoUEF2FE+HDIvFfTa3i
y6UJstKO6SveRSXfkO6i+viAAiGsigTVTzb7PFM416Xb+bgabIXW+gWVO0asekiP
v8cPB+OuOuP9oj/z0iT3rMhNhtfYu/PwC3NLMblxTh+sYrTYjJeujbuDsQJyvNVh
vZQ+xTywMX1m2kmSci54miQKZFEi6AtZ6AInC5TyU+VzJCHBlDvrIx8EEmJZAT76
HOlguXqXEFKwGgktnDlsFu96xTSrg6KvQiGziPV08GqKJ4hZIN1LCoLQ7EIQTLLg
U6GkcvmILDi3vDYCA+Um3GDOZEEXbPyYBVJu7sPk5e11YNHkb7cG+/d9FsXn5BoU
qDGGxdTN4tf/3L8FbAwt2F9TRNLx5xFlkgcKl4g4ji99Qmm5uNVIJzNE1ij1STow
ZRmoJBKcAFIBv16rJSmVUApos1tJdQ4afEQYcyMrcvcWQdqy4J3CPeMegssczBJq
qcIJ+g0XADrk+9lhVCE5eee2trLTJpuWuxQEAPOBeED1GW8rgF6+w1ZUbZslCNeS
eIGool/Ady+dn3XIVqm3lzIe1RVgTHXBhZTId9QEnYBBoAi27io=
=10QR
-----END PGP SIGNATURE-----
--- End Message ---
