Your message dated Mon, 20 Jan 2020 23:20:45 +0000 with message-id <e1itgld-000eba...@fasolo.debian.org> and subject line Bug#940871: fixed in openconnect 8.02-1.1 has caused the Debian Bug report #940871, regarding openconnect: CVE-2019-16239: Fix buffer overflow with chunked HTTP handling to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 940871: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940871 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: openconnect Version: 8.02-1 Severity: grave Tags: security upstream Justification: user security hole Control: found -1 7.08-1 Hi, The following vulnerability was published for openconnect. CVE-2019-16239[0]: | process_http_response in OpenConnect before 8.05 has a Buffer Overflow | when a malicious server uses HTTP chunked encoding with crafted chunk | sizes. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2019-16239 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16239 [1] https://github.com/openconnect/openconnect/commit/875f0a65ab73f4fb581ca870fd3a901bd278f8e8 [2] http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: openconnect Source-Version: 8.02-1.1 We believe that the bug you reported is fixed in the latest version of openconnect, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 940...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <car...@debian.org> (supplier of updated openconnect package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 18 Jan 2020 23:37:24 +0100 Source: openconnect Architecture: source Version: 8.02-1.1 Distribution: unstable Urgency: medium Maintainer: Mike Miller <mtmil...@debian.org> Changed-By: Salvatore Bonaccorso <car...@debian.org> Closes: 940871 Changes: openconnect (8.02-1.1) unstable; urgency=medium . * Non-maintainer upload. * Close HTTPS connection on failure returns from process_http_response() * Fix buffer overflow with chunked HTTP handling (CVE-2019-16239) (Closes: #940871) Checksums-Sha1: 507336c9166f8c5b88ee5d745b555ff86448262a 2759 openconnect_8.02-1.1.dsc ac6682bd5df7b8702f6f588e858d496495e2dd4c 15904 openconnect_8.02-1.1.debian.tar.xz Checksums-Sha256: 5cf225401e563e233c2042f99db9a7b68ed0ace211549fa931414c28de0ab46a 2759 openconnect_8.02-1.1.dsc c5386188413701c6db48ff20693269b69b2653edff9a5ef74251fa8656517950 15904 openconnect_8.02-1.1.debian.tar.xz Files: ff1f143fdac2eb8a9a2bc1daea4a0e59 2759 net optional openconnect_8.02-1.1.dsc cd3e30484afb4bb8f108768666aba32a 15904 net optional openconnect_8.02-1.1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl4jiilfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EIjYP/2FkcUgGmebZlTbpSt1oAeYf+eYhk7UI tGRNQYFfBMaV/dLNgYKnOb70hvu7Rcdl/H0nx7hxlGLrdmVJfccPo10NJ1vSw+8a SQi36QfA83aIPKa0LZAMtMS5JzEoGSLmwrcHLOgfaGfjHICGgzbYa9Nuw0LYb4rF bSqeGWvEzODWjaSd45KgqwJXcqvwVCBaqcsZexyxLvdgeBx7UUlc4Jo2czs0rq0U z5Ca3Me1Kp+JD171ekzaXyuadaszsCNrOYWs6urKASf8+X7ZLfjiPDmnPmdzLQIN q1uOzgbmJBMHI5+CWl0v4RJT2vY3VYFcBdEHbIKeL54Mj53p9tbZkjIf1kEtm3iA PpkkVU8dkSc4SZvzsCq8LiQTF+K0riPTXOFPVNtM1fZtLB0DUtJ+ui6uzyqRJ8mn jP25XjdfJz/na8C1+dUwLVoa8gzsOWGgjCO1DF5v2dIn9/DQroAArClszZh6QaH0 rIAeoC/IaaTJmB9qhn3P6oPh1tSy2DSxKLAnSJMA/ckGaCv64bBHf+HN5dCRVCz5 FsQWkfeNeGVCnN+agNODIvsHZ/S+TFOOTffUa2STGr+osUDARUmD7KL1DHRGAJSu NllFsGcRRzTexLbfONwr6hAA7UTEbBcqOlsM3mO5g2QDnPDRS3q5MlS57XSY4gDY ZERKA+CdbOj6 =RLbw -----END PGP SIGNATURE-----
--- End Message ---
