Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker
Commits: 2b9097a0 by Markus Koschany at 2024-06-21T23:02:02+02:00 Reassign DLA-3834-1 to netty from unbound Assigning DLA-3834-1 to unbound was premature. Fix that by using the number for netty. - - - - - aad481bc by Markus Koschany at 2024-06-21T23:02:02+02:00 Remove netty from dla-needed.txt - - - - - 5593e2fa by Markus Koschany at 2024-06-21T23:02:03+02:00 CVE-2024-33655,unbound: mark buster as ignored. Reasoning: Unbound itself is not affected by the DoS attack but it could be part of a distributed denial of service attack against other services/servers provided all conditions are met which is non-trivial to do. Ideally we could fix this scenario too. However the patch introduced new configuration options which in turn rely on features which are not present in 1.9. For instance there is no cookie support and there is also no distinction when unbound is used in a proxy scenario. My patch removed the cookie part of the patch and ignored the remote_addr / client_addr part and just used the UDP IP addr. I don't feel confident enough that this is a proper solution to the problem though. Since there is no imminent risk for unbound users I am going to mark this problem as ignored. - - - - - fc60451a by Markus Koschany at 2024-06-21T23:02:05+02:00 CVE-2024-33869,CVE-2024-33870,ghostscript: buster is not affected The gp_validate_path_len function was introduced later. - - - - - 0a202c98 by Markus Koschany at 2024-06-21T23:02:05+02:00 Return ghostscript and let someone else double-check the package. - - - - - 01d5f4db by Markus Koschany at 2024-06-21T23:13:20+02:00 Claim tryton and dlt-daemon in dla-needed.txt - - - - - 3 changed files: - data/CVE/list - data/DLA/list - data/dla-needed.txt Changes: ===================================== data/CVE/list ===================================== @@ -15350,8 +15350,8 @@ CVE-2024-0445 (The The Plus Addons for Elementor plugin for WordPress is vulnera CVE-2023-6327 (The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable ...) NOT-FOR-US: WordPress plugin CVE-2024-33655 (The DNS protocol in RFC 1035 and updates allows remote attackers to ca ...) - {DLA-3834-1} - unbound 1.20.0-1 + [buster] - unbound <ignored> (Not affected by DoS, intrusive changes) NOTE: https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt NOTE: Fixed by: https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de (release-1.20.0rc1) CVE-2024-4693 (A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci ...) @@ -15424,12 +15424,14 @@ CVE-2024-33871 CVE-2024-33870 {DSA-5692-1} - ghostscript 10.03.1~dfsg~git20240518-1 + [buster] - ghostscript <not-affected> (The vulnerable code was introduced later) NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984dc3da2dc090450407d9fbcff80 (ghostpdl-10.03.1) NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707686 CVE-2024-33869 {DSA-5692-1} - ghostscript 10.03.1~dfsg~git20240518-1 + [buster] - ghostscript <not-affected> (The vulnerable code was introduced later) NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 (ghostpdl-10.03.1) NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4 (ghostpdl-10.03.1) @@ -31093,10 +31095,10 @@ CVE-2024-29650 (An issue in @thi.ng/paths v.5.1.62 and before allows a remote at CVE-2024-29515 (File Upload vulnerability in lepton v.7.1.0 allows a remote authentica ...) NOT-FOR-US: Lepton CMS CVE-2024-29025 (Netty is an asynchronous event-driven network application framework fo ...) + {DLA-3834-1} - netty 1:4.1.48-10 (bug #1068110) [bookworm] - netty <postponed> (Minor issue, fix along with future update) [bullseye] - netty <postponed> (Minor issue, fix along with future update) - [buster] - netty <postponed> (Minor issue, HTTP multipart DoS, fix along with future update) NOTE: https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v NOTE: https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c (netty-4.1.108.Final) NOTE: https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3 ===================================== data/DLA/list ===================================== @@ -15,8 +15,8 @@ [17 Jun 2024] DLA-3835-1 roundcube - security update {CVE-2024-37383 CVE-2024-37384} [buster] - roundcube 1.3.17+dfsg.1-1~deb10u6 -[17 Jun 2024] DLA-3834-1 unbound - security update - {CVE-2024-33655} +[17 Jun 2024] DLA-3834-1 netty - security update + {CVE-2024-29025} [buster] - unbound 1.9.0-2+deb10u5 [17 Jun 2024] DLA-3833-1 php7.3 - security update {CVE-2024-5458} ===================================== data/dla-needed.txt ===================================== @@ -49,7 +49,7 @@ cyrus-imapd dcmtk (Adrian Bunk) NOTE: 20240428: Added by Front-Desk (ta) -- -dlt-daemon +dlt-daemon (Markus Koschany) NOTE: 20240519: Added by Front-Desk (utkarsh) NOTE: 20240519: 1 buffer-overflow, 1 memory leak, and 2 crashes. I think we NOTE: 20240519: can postpone these but I am in split mind. Will take it myself @@ -104,9 +104,13 @@ freeimage NOTE: 20240412: ELTS also have a need to update this package. NOTE: 20240412: We should open upstream bug reports and push fixes. See above email discussion. (ola) -- -ghostscript (Markus Koschany) +ghostscript NOTE: 20240510: Added by Front-Desk (ta) - NOTE: 20240610: Doing some final tests. (apo) + NOTE: 20240621: I am returning the package so that someone else can assess + NOTE: 20240621: whether we can fix the problems or have to ignore them. + NOTE: 20240621: The patches rely on newly introduced API,e.g. + NOTE: 20240621: gs_activate_path_control,gs_is_path_control_active. I don't + NOTE: 20240621: think it makes sense to introduce those changes without those functions. -- git (Sean Whitton) NOTE: 20240519: Added by Front-Desk (utkarsh) @@ -187,10 +191,6 @@ mariadb-10.3 NOTE: 20240610: This version is EOL and I could not find a targeted patch for the NOTE: 20240610: problem which appears to be not too serious. (apo) -- -netty (Markus Koschany) - NOTE: 20240511: Added by (apo) - NOTE: 20240610: Doing some final tests. (apo) --- nodejs (rouca) NOTE: 20240406: Added by Front-Desk (lamby) -- @@ -305,12 +305,12 @@ tinymce NOTE: 20231216: upstream's patch is backportable, as the code has changed a NOTE: 20231216: lot. (spwhitton) -- -tryton-client +tryton-client (Markus Koschany) NOTE: 20240618: Added by coordinator (santiago) NOTE: 20240618: bookworm pu by maintainer was accepted. LTS Team should take care of bullseye pu along with buster, as suggested by maintainer (santiago) NOTE: 20240618: https://salsa.debian.org/tryton-team/tryton-client/-/commit/dfa889381d572f5ee229c3eec32cbdff8084d36c -- -tryton-server +tryton-server (Markus Koschany) NOTE: 20240421: Added by Front-Desk (apo) NOTE: 20240421: Fix causes regressions in tryton client. Waiting for that NOTE: 20240421: being resolved upstream. View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a6624d77f131b34abef764fb3074fc51448461da...01d5f4db5384365753993280820d9439c2ac3fed -- This project does not include diff previews in email notifications. View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a6624d77f131b34abef764fb3074fc51448461da...01d5f4db5384365753993280820d9439c2ac3fed You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits