Your message dated Sat, 21 Jun 2025 11:47:09 +0000
with message-id <e1uswgf-00d0pl...@fasolo.debian.org>
and subject line Bug#1102006: fixed in corosync 3.1.7-1+deb12u1
has caused the Debian Bug report #1102006,
regarding corosync: CVE-2025-30472
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1102006: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1102006
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: corosync
Version: 3.1.9-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/corosync/corosync/issues/778
X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi,
The following vulnerability was published for corosync.
CVE-2025-30472[0]:
| Corosync through 3.1.9, if encryption is disabled or the attacker
| knows the encryption key, has a stack-based buffer overflow in
| orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-30472
https://www.cve.org/CVERecord?id=CVE-2025-30472
[1] https://github.com/corosync/corosync/issues/778
[2] https://github.com/corosync/corosync/pull/779
[3]
https://github.com/corosync/corosync/commit/7839990f9cdf34e55435ed90109e82709032466a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: corosync
Source-Version: 3.1.7-1+deb12u1
Done: Moritz Mühlenhoff <j...@debian.org>
We believe that the bug you reported is fixed in the latest version of
corosync, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1102...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Moritz Mühlenhoff <j...@debian.org> (supplier of updated corosync package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 18 May 2025 21:16:40 +0200
Source: corosync
Architecture: source
Version: 3.1.7-1+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Debian HA Maintainers
<debian-ha-maintain...@lists.alioth.debian.org>
Changed-By: Moritz Mühlenhoff <j...@debian.org>
Closes: 1102006
Changes:
corosync (3.1.7-1+deb12u1) bookworm; urgency=medium
.
* CVE-2025-30472 (Closes: #1102006)
Checksums-Sha1:
fe768741b88e2371e22e0541609bfcbe31367bbe 3530 corosync_3.1.7-1+deb12u1.dsc
f6385df2628c88bf1b331fc37ee606b94715dbd5 27624
corosync_3.1.7-1+deb12u1.debian.tar.xz
b3437b61934fb182b71002597b77b20875dfd1c7 17813
corosync_3.1.7-1+deb12u1_amd64.buildinfo
Checksums-Sha256:
c979a3ea9af03692d5ae8bfe99a213ab146c23db86e2aa7fcd6dfaaeb433577a 3530
corosync_3.1.7-1+deb12u1.dsc
ce7ce6275fa475e199ae7a0fc490dc13ef0311370e4d888443d9cfa8f9aa2475 27624
corosync_3.1.7-1+deb12u1.debian.tar.xz
e7db2c285b4974ecbcf89c4df2cfce8620febb7d94a8ad2cce2fb43fb17529d3 17813
corosync_3.1.7-1+deb12u1_amd64.buildinfo
Files:
639ebc6b974747fcb1cdd8115732118c 3530 admin optional
corosync_3.1.7-1+deb12u1.dsc
6a420efab5eabab5dd5a2773088cbb95 27624 admin optional
corosync_3.1.7-1+deb12u1.debian.tar.xz
3daf4a4c86bf12ad89b27d9df9742c96 17813 admin optional
corosync_3.1.7-1+deb12u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmg/YXgACgkQEMKTtsN8
TjZFBhAAkc21pzRO8JJ3e2/rNZ4U0T0uuShP6n7IFS7Wm1RXZi+EUXC9oxkDvqWV
Br/OWeZXgx/7jZLtBxVDUyo7zOJH/5DP7SiylOx3+oacTfpVfqIrimAdo/85MXW9
QG5rvqiSVu8GbhwNVBc4jW9nsApcz/c/KVtXJduTpjcnVrrHyVm1tLhvQUCFeY44
tOtOaxKLnqq/WGF+9Oil3WXK5bIsjqrzRtORR7f/P65OdtuWzp9Lgaqrp0YiZxEU
2qDyAWouzp/tVRS4GQAUF9SBuCLsCYfq19LPvqeBbz/8z5KAZ5+oFlmTymQnbWEg
mMDIVAFjv31H7EFtGgZVJkVGvyGHoPp8bzmTEPMjbwE/b8C3CO83e/omKj7qfgAs
UHyQOzYxbww76nviaqwltotQ0gUtU59/08gcUphnAsP+usZ4FKeNdhSBYDYDc85Q
tQ3TZWZz0L1E6r8MsfraEEysl1F+fZqEGFlEmX0puJFeF+tyYEjCYKlUqWPO67/b
ZsKwf1KzlnmiF5WoRmhUl4cZACe+MaJwbbaUZy7yrP7mjqGBmQcTMlr83HDW3v3s
Dx5qVWnwuxm18okS0xr/UJ7EKV9mZO3ImClcWvQf4jgBsOzOA0/l0PYU2w2DsYxG
ahjFGYsBGKQloi6MsR+ryteyMEMhtSVX4PsD4Iktwszx1Jgz5w0=
=srxC
-----END PGP SIGNATURE-----
pgpfxZAsyrfYE.pgp
Description: PGP signature
--- End Message ---
