Your message dated Fri, 18 Feb 2022 12:49:11 +0000
with message-id <[email protected]>
and subject line Bug#1005784: fixed in policykit-1 0.120-6
has caused the Debian Bug report #1005784,
regarding policykit-1: CVE-2021-4115: file descriptor leak allows an
unprivileged user to cause a crash
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1005784: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005784
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: policykit-1
Version: 0.105-31.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 0.105-31
Control: found -1 0.105-31+deb11u1
Control: found -1 0.105-25
Control: found -1 0.105-25+deb10u1
Hi,
The following vulnerability was published for policykit-1.
CVE-2021-4115[0]:
| file descriptor leak allows an unprivileged user to cause a crash
See [1]. Upstream has not yet pushed the commit into the repository,
Simon, Michael opinions on the DSA need? *If* it's automatically
restarted after crash, then we can schedule the fixes via the upcoming
point releases IMHO.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2021-4115
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4115
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2007534
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: policykit-1
Source-Version: 0.120-6
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
policykit-1, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated policykit-1 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 18 Feb 2022 10:04:56 +0000
Source: policykit-1
Architecture: source
Version: 0.120-6
Distribution: experimental
Urgency: medium
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1005784
Changes:
policykit-1 (0.120-6) experimental; urgency=medium
.
* Add patch from Fedora to fix denial of service via fd exhaustion
(CVE-2021-4115; Closes: #1005784)
Checksums-Sha1:
b6b7295d41dc3750d7b0e5c345d92807fc9b963d 3488 policykit-1_0.120-6.dsc
1a76353eb3536f93fc961d8c6c5a4195f8396684 61568
policykit-1_0.120-6.debian.tar.xz
124ca5c8e7482a6ac88837ba96b67d84eaa21fcb 8853
policykit-1_0.120-6_source.buildinfo
Checksums-Sha256:
8b90b636bf2f9515a7fb5ca07ce4c44e6626da2ec8409de9391679fd261df992 3488
policykit-1_0.120-6.dsc
d312c7484f0f02a5fba401ee26d2571ec273ccd728e4d0e8435f2970cc073653 61568
policykit-1_0.120-6.debian.tar.xz
9388552618794d78c24874b16e64008ca0a2cf059cfc56e78ea81c7743f61f10 8853
policykit-1_0.120-6_source.buildinfo
Files:
73dd1929f5c58d2d7fafdb604e6e7a7d 3488 admin optional policykit-1_0.120-6.dsc
95df71de93e6aea3228634ae2d389768 61568 admin optional
policykit-1_0.120-6.debian.tar.xz
b1688aa25031eaa6414d5f6e02d1e6a2 8853 admin optional
policykit-1_0.120-6_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEENuxaZEik9e95vv6Y4FrhR4+BTE8FAmIPkgAACgkQ4FrhR4+B
TE92HQ/+IIEQ/owzlvUzGRbivLXZg1v0QkCxbKHutsaF0W5pmRX4SIHEjgD/6Uph
s9rCtLCNCvQ9joz3gcItcItrDemIB0aexDu1xWR3H/Hzq//8irWyYRmeyoJoqFf5
UVaO5Draz2SAqPK6+fcgWGv8F8RZ28Y7eku/eANBVw4PT6maVlp846uNrdZqh2NG
NFSAifhmI8VO/Dcbf2yVwyfV0H1el1BL877i1CbIJojQ5rmOfCKPOamYKqX2RKAl
0Gdvqz5d7Y4a/WRribubEmhGiqg2UjTh34iVULuIW8fkjxK9EVpOaecGSJDd+ExK
a1aYABveIMqN6Mxzzqm4Im28pRwt5ybSljoyb816JuOwBFi2Dr4CQb/lvSNJUR84
OQSq3tz2dvg+fSUirDpAjGQ+se4CyPUpdNbk5Asb4A+XQp7h/wF8FGDxWnOdB310
Za08cJAfNM2UEAfOTjgjIvWbGBKN6dmHI/x2Y03VsJ7Xd0+xtZWAAxA35kmdJa3E
V/8azXZv2Ym94TrMTpQY2/at9KhGGY4HIQiCWpXxlgDvWimMSQc5FgvlyWTYPJxj
6MawVRH11xo1cfYSv/QeeNOrmX5wnYtmmgG7CA+lC6Mjj8d7gACuJLdOSjkuMpc0
SCtph2OslfDt/1Y/O+LqTGhZTmIUqI+1XyDD1hLFYfIPVpXcDq8=
=SdZA
-----END PGP SIGNATURE-----
--- End Message ---
