Bug#755197: bozohttpd: security hole: basic http authentication bypass

2014-07-19 Thread Perry E. Metzger
On Sat, 19 Jul 2014 21:05:35 +0200 Salvatore Bonaccorso wrote: > It was assigned on oss-security mailing list by MITRE: > > https://marc.info/?l=oss-security&m=140572157701095&w=2 > > I think CVE-2013-5015 is "SQL injection vulnerability in the > management console in Symantec Endpoint Protectio

Bug#755197: bozohttpd: security hole: basic http authentication bypass

2014-07-19 Thread Salvatore Bonaccorso
Hi Perry, On Sat, Jul 19, 2014 at 01:38:07PM -0400, Perry E. Metzger wrote: > On Sat, 19 Jul 2014 06:09:48 +0200 Salvatore Bonaccorso > wrote: > > A CVE was assigned now for this issue (CVE-2014-5015). Plese > > reference this CVE ID in the changelog when fixing this issue. > > I'm afraid that C

Bug#755197: bozohttpd: security hole: basic http authentication bypass

2014-07-19 Thread Perry E. Metzger
On Sat, 19 Jul 2014 06:09:48 +0200 Salvatore Bonaccorso wrote: > A CVE was assigned now for this issue (CVE-2014-5015). Plese > reference this CVE ID in the changelog when fixing this issue. I'm afraid that CVE is "SQL injection vulnerability in the management console in Symantec Endpoint Protect

Bug#755197: bozohttpd: security hole: basic http authentication bypass

2014-07-18 Thread Salvatore Bonaccorso
Hi A CVE was assigned now for this issue (CVE-2014-5015). Plese reference this CVE ID in the changelog when fixing this issue. Regards, Salvatore -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#755197: bozohttpd: security hole: basic http authentication bypass

2014-07-18 Thread Perry E. Metzger
Package: bozohttpd Version: 2018-1 Severity: grave Tags: security upstream Justification: user security hole Dear Maintainer, The upstream version of the program has a hole in basic http authentication. It has been patched in the latest version available from the author. See: http://www.etern