Your message dated Thu, 4 May 2023 08:49:45 +0200
with message-id <zfnvizpl26xvm...@eldamar.lan>
and subject line Re: Accepted netatalk 3.1.15~ds-1 (source) into unstable
has caused the Debian Bug report #1034170,
regarding netatalk: CVE-2022-43634
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1034170: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034170
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: netatalk
X-Debbugs-CC: t...@security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerability was published for netatalk.
CVE-2022-43634[0]:
| This vulnerability allows remote attackers to execute arbitrary code
| on affected installations of Netatalk. Authentication is not required
| to exploit this vulnerability. The specific flaw exists within the
| dsi_writeinit function. The issue results from the lack of proper
| validation of the length of user-supplied data prior to copying it to
| a fixed-length heap-based buffer. An attacker can leverage this
| vulnerability to execute code in the context of root. Was ZDI-
| CAN-17646.
https://github.com/Netatalk/Netatalk/pull/186
https://github.com/advisories/GHSA-fwj9-7qq8-jc93
https://www.zerodayinitiative.com/advisories/ZDI-23-094/
https://github.com/Netatalk/netatalk/commit/5fcb4ab02aced14484310165b3d754bb2f0820ca
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-43634
https://www.cve.org/CVERecord?id=CVE-2022-43634
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: netatalk
Source-Version: 3.1.15~ds-1
On Tue, May 02, 2023 at 07:03:55PM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Tue, 02 May 2023 20:13:06 +0200
> Source: netatalk
> Architecture: source
> Version: 3.1.15~ds-1
> Distribution: unstable
> Urgency: high
> Maintainer: Debian Netatalk team <pkg-netatalk-de...@lists.alioth.debian.org>
> Changed-By: Jonas Smedegaard <d...@jones.dk>
> Closes: 1013308 1024021 1025011
> Changes:
> netatalk (3.1.15~ds-1) unstable; urgency=high
> .
> [ upstream ]
> * new release
> + fixes CVE-2022-45188 CVE-2022-45188;
> closes: bug#1024021, thanks to Moritz Mühlenhoff
And seems to fix as well CVE-2022-43634, in the netatalk-3-1-15
upstream tag with
https://github.com/Netatalk/netatalk/commit/e6a9ce5b8145d0b39851fbf80916035a714e9d59
. Marking #1034170 as closed as well.
Regards,
Salvatore
--- End Message ---
