Your message dated Sat, 29 Jun 2024 10:47:48 +0000 with message-id <e1snvcs-002btk...@coccia.debian.org> and subject line Released with 11.10 has caused the Debian Bug report #1073206, regarding bullseye-pu: package python-aiosmtpd/1.2.2-1+deb11u1 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 1073206: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073206 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: release.debian.org Severity: normal Tags: bullseye X-Debbugs-Cc: python-aiosm...@packages.debian.org, d...@dalerichards.net Control: affects -1 + src:python-aiosmtpd User: release.debian....@packages.debian.org Usertags: pu [ Reason ] This update resolves two security vulnerabilities present in the version of python-aiosmtpd in Bullseye (1.2.2-1): * CVE-2024-27305 - SMTP smuggling due to poor handling of non-standard line endings (Bug: #1066820) * CVE-2024-34083 - STARTTLS unencrypted command injection (Bug: #1072119) These have both been deemed unworthy of a DSA, but the Security Team have suggested we update this package for the next Bullseye point release. [ Impact ] Without this update, Debian 11 systems running aiosmtpd would remain vulnerable to the two CVEs listed above. [ Tests ] The upstream package includes a comprehensive suite of tests, all of which are passing with this new version. Additionally, I have installed the new package on a Bullseye test box and performed manual testing, confirming that the package's main functionality works and that the two vulnerabilties are correctly resolved. [ Risks ] The code changes are minor, and bring aiosmtpd into compliance with the relevant sections of RFC 3207[1] and RFC 5321[2]. The update can therefore be considered low risk, and will not cause an issue with any RFC-compliant SMTP client or MTA. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * CVE-2024-27305 - Patch aiosmtpd/smtp.py to accept only <CRLF> as a line terminator, as mandated by RFC 5321[2]. This patch has been adapted from the fix committed upstream[3]. * CVE-2024-34083 - Patch aiosmtpd/smtp.py to discard any remaining unencrypted data in the input buffer upon completion of a STARTTLS handshake, as mandated by RFC 3207[1]. This patch has been adapted from the fix committed upstream[4]. [ Other info ] References: [1] https://datatracker.ietf.org/doc/html/rfc3207#page-7 [2] https://datatracker.ietf.org/doc/html/rfc5321#section-2.3.8 [3] https://github.com/aio- libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb [4] https://github.com/aio- libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfdadiff -Nru python-aiosmtpd-1.2.2/debian/changelog python-aiosmtpd-1.2.2/debian/changelog --- python-aiosmtpd-1.2.2/debian/changelog 2020-12-19 15:05:26.000000000 +0000 +++ python-aiosmtpd-1.2.2/debian/changelog 2024-06-14 14:09:42.000000000 +0100 @@ -1,3 +1,13 @@ +python-aiosmtpd (1.2.2-1+deb11u1) bullseye; urgency=medium + + * Team upload. + * CVE-2024-27305 - SMTP smuggling due to poor handling of + non-standard line endings (Closes: #1066820) + * CVE-2024-34083 - STARTTLS unencrypted command injection + (Closes: #1072119) + + -- Dale Richards <d...@dalerichards.net> Fri, 14 Jun 2024 14:09:42 +0100 + python-aiosmtpd (1.2.2-1) unstable; urgency=medium [ Ondřej Nový ] diff -Nru python-aiosmtpd-1.2.2/debian/patches/0005-cve-2024-34083.patch python-aiosmtpd-1.2.2/debian/patches/0005-cve-2024-34083.patch --- python-aiosmtpd-1.2.2/debian/patches/0005-cve-2024-34083.patch 1970-01-01 01:00:00.000000000 +0100 +++ python-aiosmtpd-1.2.2/debian/patches/0005-cve-2024-34083.patch 2024-06-14 14:09:42.000000000 +0100 @@ -0,0 +1,19 @@ +Description: CVE-2024-34083 - STARTTLS unencrypted command injection +Author: Dale Richards <d...@dalerichards.net> +Origin: upstream, https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc383541fcdbfda +Bug: https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8 +Last-Update: 2024-06-07 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +--- a/aiosmtpd/smtp.py ++++ b/aiosmtpd/smtp.py +@@ -209,6 +209,9 @@ + self._reader._transport = transport + self._writer._transport = transport + self.transport = transport ++ # Discard any leftover unencrypted data ++ # See https://tools.ietf.org/html/rfc3207#page-7 ++ self._reader._buffer.clear() # type: ignore[attr-defined] + # Do SSL certificate checking as rfc3207 part 4.1 says. Why is + # _extra a protected attribute? + self.session.ssl = self._tls_protocol._extra diff -Nru python-aiosmtpd-1.2.2/debian/patches/0006-cve-2024-27305.patch python-aiosmtpd-1.2.2/debian/patches/0006-cve-2024-27305.patch --- python-aiosmtpd-1.2.2/debian/patches/0006-cve-2024-27305.patch 1970-01-01 01:00:00.000000000 +0100 +++ python-aiosmtpd-1.2.2/debian/patches/0006-cve-2024-27305.patch 2024-06-14 14:09:42.000000000 +0100 @@ -0,0 +1,30 @@ +Description: CVE-2024-27305 - SMTP smuggling + SMTP smuggling due to poor handling of + non-standard line endings +Author: Dale Richards <d...@dalerichards.net> +Origin: upstream, https://github.com/aio-libs/aiosmtpd/commit/24b6c79c8921cf1800e27ca144f4f37023982bbb +Bug: https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-pr2m-px7j-xg65 +Last-Update: 2024-06-07 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +--- a/aiosmtpd/smtp.py ++++ b/aiosmtpd/smtp.py +@@ -31,7 +31,7 @@ + + DATA_SIZE_DEFAULT = 33554432 + EMPTYBYTES = b'' +-NEWLINE = '\n' ++NEWLINE = '\r\n' + + + class _Missing: +@@ -876,7 +876,8 @@ + size_exceeded = False + while self.transport is not None: # pragma: nobranch + try: +- line = await self._reader.readline() ++ # https://datatracker.ietf.org/doc/html/rfc5321#section-2.3.8 ++ line: bytes = await self._reader.readuntil(b'\r\n') + log.debug('DATA readline: %s', line) + except asyncio.CancelledError: + # The connection got reset during the DATA command. diff -Nru python-aiosmtpd-1.2.2/debian/patches/series python-aiosmtpd-1.2.2/debian/patches/series --- python-aiosmtpd-1.2.2/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ python-aiosmtpd-1.2.2/debian/patches/series 2024-06-14 14:09:42.000000000 +0100 @@ -0,0 +1,2 @@ +0006-cve-2024-27305.patch +0005-cve-2024-34083.patch
--- End Message ---
--- Begin Message ---Version: 11.10 The upload requested in this bug has been released as part of 11.10.
--- End Message ---
