Your message dated Tue, 11 Nov 2014 09:21:28 +0000 with message-id <e1xo7dg-0005gk...@franck.debian.org> and subject line Bug#768294: fixed in freeipa 4.0.5-1 has caused the Debian Bug report #768294, regarding freeipa: CVE-2014-7828: password not required when OTP in use to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 768294: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768294 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: freeipa Version: 4.0.4-2 Severity: grave Tags: security upstream patch Hi, the following vulnerability was published for freeipa. CVE-2014-7828[0]: password not required when OTP in use See [1] for details and upstream ticket[2]. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2014-7828 [1] https://www.redhat.com/archives/freeipa-devel/2014-November/msg00068.html [2] https://fedorahosted.org/freeipa/ticket/4690 Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: freeipa Source-Version: 4.0.5-1 We believe that the bug you reported is fixed in the latest version of freeipa, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 768...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Timo Aaltonen <tjaal...@debian.org> (supplier of updated freeipa package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Tue, 11 Nov 2014 10:38:52 +0200 Source: freeipa Binary: freeipa-server freeipa-server-trust-ad freeipa-client freeipa-admintools freeipa-tests python-freeipa Architecture: source amd64 Version: 4.0.5-1 Distribution: unstable Urgency: medium Maintainer: Debian FreeIPA Team <pkg-freeipa-de...@lists.alioth.debian.org> Changed-By: Timo Aaltonen <tjaal...@debian.org> Description: freeipa-admintools - FreeIPA centralized identity framework -- admintools freeipa-client - FreeIPA centralized identity framework -- client freeipa-server - FreeIPA centralized identity framework -- server freeipa-server-trust-ad - FreeIPA centralized identity framework -- AD trust installer freeipa-tests - FreeIPA centralized identity framework -- tests python-freeipa - FreeIPA centralized identity framework -- Python modules Closes: 768122 768187 768294 769037 Changes: freeipa (4.0.5-1) unstable; urgency=medium . * New upstream release - Fix CVE-2014-7828. (Closes: #768294) * control: Update my email address. * fix-bind-conf.diff, add-debian-platform.diff: Fix bind config template to use Debian specific paths, and replace named.conf not named.conf.local. (Closes: #768122) * rules, -server.postinst: Create /var/cache/bind/data owned by bind user. * rules: Fix /var/lib/ipa/backup permissions. * Add non-standard-dir-perm to server lintian overrides. * copyright: Fix a typo. * control: Bump dependency on bind9-dyndb-ldap to 6.0-4~. * control: Move dependency on python-qrcode and python-yubico from server to python-freeipa and drop python-selinux which belongs to pki-server. * control: Relax libxmlrpc-core-c3-dev buil-dep and 389-ds-base dep for easier backporting. * control: Add python-dateutils to server, and python-dbus and python- memcache to python-freeipa dependencies. (Closes: #768187) * platform: Handle /etc/default/nfs-common and /etc/default/autofs, drop NSS_DB_DIR since it's inherited already. (Closes: #769037) * control: Bump policy to 3.9.6, no changes. Checksums-Sha1: e7a21e9a8dea3987c587aba764228acfadb73a59 2980 freeipa_4.0.5-1.dsc 1b690aae94b34e81a612363a4624994f14ffd79f 4730699 freeipa_4.0.5.orig.tar.gz 5ab3c24b7f22416ea617df4c0956d2425e55b9f8 21684 freeipa_4.0.5-1.debian.tar.xz 976d0a4ffad604489e97c40c15fd435337aac2f8 688738 freeipa-server_4.0.5-1_amd64.deb fc09721587cfb64e853ce387d2ba08801d6084fe 77262 freeipa-server-trust-ad_4.0.5-1_amd64.deb 1272261305649c9e3b19e3544f2314ec1b16a68d 82428 freeipa-client_4.0.5-1_amd64.deb 9cdd08fa42330b40ef01f6685fe2be08167cd4fb 12868 freeipa-admintools_4.0.5-1_amd64.deb 20ca014e840ced292f777699250ef6016084a286 220542 freeipa-tests_4.0.5-1_amd64.deb 2ced9c8ce071da6f7100c92dac0f3f5d5312aa0d 518254 python-freeipa_4.0.5-1_amd64.deb Checksums-Sha256: 4bf6e4f2ee06991e4bd4d0d77150ab389a097133c3b27efe708d13da517a1891 2980 freeipa_4.0.5-1.dsc fa95de2b99d242a4a794d316bc272333e954eefd2857ebdac7380ceabca5c8cd 4730699 freeipa_4.0.5.orig.tar.gz cd54f522ae95050554ad7bdf3504b9458e7d1cdadd63057f0b331ec7ea603137 21684 freeipa_4.0.5-1.debian.tar.xz c7712b2450baf8a025a9829fd71f4c86fede2f0294403b11916308ae95af4a91 688738 freeipa-server_4.0.5-1_amd64.deb 05d1cb3246c044a918df23ce06787fbedae1614d8d92c4797a7a6175203b8a6e 77262 freeipa-server-trust-ad_4.0.5-1_amd64.deb 27466c1f5dc229b3299b6b313f3aae4974539e1af82e14a9866b36fd25622954 82428 freeipa-client_4.0.5-1_amd64.deb 27eadd5d8e294b9cfdb6c91315d50c99b20224b0cba88deae2c6e0c27fdafc05 12868 freeipa-admintools_4.0.5-1_amd64.deb ef35c88419a3bd44b59e05c37e9ec8e63a11198b31addf6724ac8053150b98b2 220542 freeipa-tests_4.0.5-1_amd64.deb 8701f101ecd732f16ca023ce6c80e920d02fe957eb79097cd8ce6c4cbcdf88aa 518254 python-freeipa_4.0.5-1_amd64.deb Files: b889c3f60a7cb9221a89a1182d5e0752 2980 net extra freeipa_4.0.5-1.dsc dc0ebfe24a20bd850641df05ff0a7268 4730699 net extra freeipa_4.0.5.orig.tar.gz 838a684bfb35a1e1dfd41a5a26a72399 21684 net extra freeipa_4.0.5-1.debian.tar.xz 6d521796b4d68c75fedc04309e5ebe8b 688738 net extra freeipa-server_4.0.5-1_amd64.deb be5b4c8830e6edc2a7e817fd9b9db454 77262 net extra freeipa-server-trust-ad_4.0.5-1_amd64.deb 1ad855f09aea880f4cdfafbb0f8c63be 82428 net extra freeipa-client_4.0.5-1_amd64.deb 83aa40f0d87636f3a75da16afdf738da 12868 net extra freeipa-admintools_4.0.5-1_amd64.deb 516b26954182ea806ef45a06806c0f34 220542 net extra freeipa-tests_4.0.5-1_amd64.deb 79694996af91154771312f6b278141a7 518254 python extra python-freeipa_4.0.5-1_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUYdDaAAoJEMtwMWWoiYTcJA4P/RDRgVa8cY/47FVfEwim5YPz pLWn4BjOk3yO8e7rM9C8HPz+z79b9nZiTiagLvjLwzFy/1in+xMWld61HGwwILhB RO8mEGMHCtJqHxYrvq9s16t86qws5NWIAwvExgqbcSVbCIvX948/8cbWycUe5FBB iNYBT1FGQi6gFKGQCqWWAFewSPuZg+PBiZlk2aN5hhklmaN5oKd7MHVeCjEstmQ6 J0gxdEfRVFo31zOGeU3Aib87iDoYbN0DYYHLQUGzGjBebWPmk24JaEEXdTgbCH4b 9dP0fzkewKln/Wn+HeHfUEDjRX9jP5K58kulDmwgUTUXRnvpuCzhUD/c6dc5038g 7MY2X/2/jR1E1qxy2xMAxDuEvKY0SRmzxK8YpM2koHw5MnVUSUiwvYXl5THmLnw+ RqfvENqwX5LMKOg1C35zOmKDJwqW1bSnvNLzrlXph4tdraUoWcx1E0wx61co1Sor UY9i+bBlsjocWmW8k95jsvGadz99ZmSO8447b0LIgw8doTHDeQ+52VZFnom7Oueo nfOxO73ZDjG66Yx87boAjZc85nb6Y49LoUpak8pvSlN2mW0Ac4RkK6BfOFV01V6r UHvAlyVfOZ6CMFT2fXIVdHg5/Zv0xoRDpGtUPDdaN4XmfMKfLfPW9AxWjbBPZJpM 8NL/VFRfK4Kcjnac8+/G =Kd9z -----END PGP SIGNATURE-----
--- End Message ---
