Bug#923009: seafile: CVE-2013-7469

2019-03-08 Thread Moritz Schlarb
Hi there, we've been in touch with the upstream developers and I want to add the following to the discussion: After reading through the code thoroughly, I want to add the clarification, that the summary of the CVE is not really correct: Every encrypted library uses the same salt. (That will be f

Bug#923009: seafile: CVE-2013-7469

2019-03-07 Thread Salvatore Bonaccorso
Control: severity -1 important Control: tags -1 - buster-ignore Hi Christoph, On Thu, Mar 07, 2019 at 10:16:46AM +0100, Christoph Martin wrote: > Hi Salvatore, > > Am 06.03.19 um 23:15 schrieb Salvatore Bonaccorso: > > Hi Christoph, > > > > On Tue, Mar 05, 2019 at 12:12:31PM +0100, Christoph Ma

Bug#923009: seafile: CVE-2013-7469

2019-03-07 Thread Christoph Martin
Hi Salvatore, Am 06.03.19 um 23:15 schrieb Salvatore Bonaccorso: > Hi Christoph, > > On Tue, Mar 05, 2019 at 12:12:31PM +0100, Christoph Martin wrote: > > Yes I think we can agree on that! > So, I'd like to lower the severity to important, > Quick note on the buster-ignore tag addition, keep

Bug#923009: seafile: CVE-2013-7469

2019-03-06 Thread Salvatore Bonaccorso
Hi Christoph, On Tue, Mar 05, 2019 at 12:12:31PM +0100, Christoph Martin wrote: > Control: tags -1 buster-ignore > > Am 22.02.19 um 23:46 schrieb Salvatore Bonaccorso: > > Source: seafile > > Version: 6.2.11-1 > > Severity: grave > > Tags: security upstream > > Forwarded: https://github.com/haiwe

Bug#923009: seafile: CVE-2013-7469

2019-03-05 Thread Christoph Martin
Control: tags -1 buster-ignore Am 22.02.19 um 23:46 schrieb Salvatore Bonaccorso: > Source: seafile > Version: 6.2.11-1 > Severity: grave > Tags: security upstream > Forwarded: https://github.com/haiwen/seafile/issues/350 > > Hi, > > The following vulnerability was published for seafile. > > CV

Bug#923009: seafile: CVE-2013-7469

2019-02-22 Thread Salvatore Bonaccorso
Source: seafile Version: 6.2.11-1 Severity: grave Tags: security upstream Forwarded: https://github.com/haiwen/seafile/issues/350 Hi, The following vulnerability was published for seafile. CVE-2013-7469[0]: | Seafile through 6.2.11 always uses the same Initialization Vector (IV) | with Cipher Bl