Your message dated Sat, 02 Jun 2018 06:49:23 +0000 with message-id <e1fp0lr-000cgw...@fasolo.debian.org> and subject line Bug#900608: fixed in nikto 1:2.1.5-3 has caused the Debian Bug report #900608, regarding nikto: CVE-2018-11652 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 900608: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900608 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: nikto Version: 1:2.1.5-1 Severity: grave Tags: patch security upstream fixed-upstream Justification: user security hole Hi, The following vulnerability was published for nikto. CVE-2018-11652[0]: | CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote | attackers to inject arbitrary OS commands via the Server field in an | HTTP response header, which is directly injected into a CSV report. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-11652 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11652 [1] https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7 Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: nikto Source-Version: 1:2.1.5-3 We believe that the bug you reported is fixed in the latest version of nikto, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 900...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Vincent Bernat <ber...@debian.org> (supplier of updated nikto package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 02 Jun 2018 08:07:33 +0200 Source: nikto Binary: nikto Architecture: source Version: 1:2.1.5-3 Distribution: unstable Urgency: high Maintainer: Vincent Bernat <ber...@debian.org> Changed-By: Vincent Bernat <ber...@debian.org> Description: nikto - web server security scanner Closes: 900608 Changes: nikto (1:2.1.5-3) unstable; urgency=high . * d/control: point Vcs-* to salsa.debian.org. * d/patches: fix CSV injection vulnerability. CVE-2018-11652. Closes: #900608. Checksums-Sha1: 8884037995ecfa0e3a484e397e6213b7201f4207 1802 nikto_2.1.5-3.dsc c8f58f77726397e4fafbc482340b1377d0c4aee6 6872 nikto_2.1.5-3.debian.tar.xz b4662a49219d7370a09226af3cb150ce9c5f111c 5606 nikto_2.1.5-3_amd64.buildinfo Checksums-Sha256: 5105eb13f6e2b18f67719051c8f409daf69893d98d800a9d831114bb32fe1bf5 1802 nikto_2.1.5-3.dsc dcb94f8c24ca4119f0810177ce29a647dc92c0ea235ef67cabc30c314a7d26b4 6872 nikto_2.1.5-3.debian.tar.xz d5da87f98c75b7d59c7b41f9e85d36ca2771956fb8b26e933fc03b6ff5ee7d68 5606 nikto_2.1.5-3_amd64.buildinfo Files: b9edd7db4294222579b60d37c1e0f70d 1802 non-free/net extra nikto_2.1.5-3.dsc 1d7573b08fa3d836bfcc50c3348701fe 6872 non-free/net extra nikto_2.1.5-3.debian.tar.xz 7b62ccf705e93198db33c06a171a1d42 5606 non-free/net extra nikto_2.1.5-3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCAAwFiEErvI0h2bzccaJpzYAlaQv6DU1JfkFAlsSOdwSHGJlcm5hdEBk ZWJpYW4ub3JnAAoJEJWkL+g1NSX5+NEP/Rkwplm677cs2wFJp12gtwa3Wo1AbE2o 8TKigebitm4sTku/GjbaP94vLtuHoa3YXm+guYKU28rN1UaAyOijufPES25Tpapa 0ue6pmhJZG6jbEh+gbPk3oDiC5IubBFQNSxsvLAfx+f8TKsT7LL96uYvaBGfIkfm mvDOl79xW4i6nebP1rhq/0TnQybJ2ud3LoywLMa4AaWhojITeH1pxGc+4lPWsUJA giB/nXzJTHMcNQm7nKbz0d0cZNcaWn6H6suUhnjwHXxR3AN1Icux0LwtJef1Lc11 nhJSZn8DgWwddsRe8/OQ0MvauR/gZjzOY6EZw+MJHkoGGDyl+5Seqo01UQLitgVj TolaaU/i+b4TGHqmU95cM/4nn2vhS+eJPM96bq/LOT2p915CtpAohCx4Oa43Dbqb WwNAdTBQW8AsC5uwPKmyjhh5LQoIf80cLOKnJEIniop1Lzrmkrhx+2wm5tTZsFD6 cnGRv6W+Wl9AR4wHc977H+EetB2W3sF8YgbbFcW/fIo61P5M0lQsOiIsyAchxeM+ xl8tuSpqFBM/cVyAC+zlvFRvCHihJJ/uwdWWaWxVFQWnxD6vewS/x/qMEMvkkykQ KL2HFHH83XJh6RDoDFmWTz8nsIMXUls3rlkQc0pUOhLdkluhNtScHLgisgwrKPIM gf0bOUo1nPR8 =/KnC -----END PGP SIGNATURE-----
--- End Message ---
