Bug#386814: closed by Stephan A Suerken <[EMAIL PROTECTED]> (Bug#386814: fixed in uae 0.8.25-2)

2006-10-16 Thread Joshua Rodman
On Fri, Oct 06, 2006 at 04:20:03PM -0700, Debian Bug Tracking System wrote: > Source: uae > Source-Version: 0.8.25-2 > > We believe that the bug you reported is fixed in the latest version of > uae, which is due to be installed in the Debian FTP archive: > > uae_0.8.25-2.diff.gz > to pool/contr

Bug#345823: apt: Key error at year turnover resembles security problem, and may represent one

2006-01-04 Thread Joshua Rodman
On Wed, Jan 04, 2006 at 03:01:35AM +0100, Jeroen van Wolffelaar wrote: > Fwiw, the Release.gpg file contains two signatures now, both one with the > 2005 key and the 2006 key, to have a short transition period. The archive > still validates with the 2005 key, which isn't expired yet, and I think AP

Bug#330827: IP vetting is weak, allowing targetted DoS via usernames

2005-10-03 Thread Joshua Rodman
On Mon, Oct 03, 2005 at 10:24:09PM -0400, Yaroslav Halchenko wrote: > Besides that regular users or sysadmins are not even supposed to "tune" > failregex to have basic functionality to be performed. Me (and the upstream) > author are going to incorporate or at least include in the package more > of

Bug#330827: IP vetting is weak, allowing targetted DoS via usernames

2005-10-03 Thread Joshua Rodman
On Sat, Oct 01, 2005 at 03:04:20AM -0400, Yaroslav Halchenko wrote: > Hi Joshua, > > Thank you for you feedback. If you have a moment > could you please give a try to the "fixed" revision. I've placed in > changelog entry which states that it is necessary to update config file > to have the breach

Bug#330827: IP vetting is weak, allowing targetted DoS via usernames

2005-09-29 Thread Joshua Rodman
> Thank you for raising the issue. Indeed that is a grave problem. > Unfortunately upstream author is away for a week or two, thus I will try > to resolve the issue on my own. I think that I will simply incorporate > regex for IPs inside failregex config options, thus IP addresses will > not be ha

Bug#330827: IP vetting is weak, allowing targetted DoS via usernames

2005-09-29 Thread Joshua Rodman
Package: fail2ban Version: 0.5.2-4 Severity: grave fail2ban's approach to identifying an IP address in a login failure line is to scan the line for all IP addresses. Since it is possible to generate false logins from accounts such as 10.2.28.2, it is possible to force fail2ban to block access to