Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1008080 > unrolled thread

Bug#959763: shadowsocks-libev: Security vulnerabilities in buster

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#959763: shadowsocks-libev: Security vulnerabilities in buster John Goerzen <jgoerzen@complete.org> - 2020-05-05 04:40 +0200
    Bug#959763: shadowsocks-libev: Security vulnerabilities in buster Salvatore Bonaccorso <carnil@debian.org> - 2020-05-05 06:50 +0200

#1008080 — Bug#959763: shadowsocks-libev: Security vulnerabilities in buster

Package: shadowsocks-libev
Version: 3.2.5+ds-1
Severity: normal
Tags: security

Per https://github.com/shadowsocks/shadowsocks-libev/blob/master/debian/changelog :

shadowsocks-libev (3.3.4-1) unstable; urgency=medium

  * Minor bug fixes. (#2539, #2565, #2566, #2577)
  * Security bug fixes. (CVE-2019-5163, CVE-2019-5164)

It would be good to get this version, or at least these patches, into
buster security updates.


-- System Information:
Debian Release: 10.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-8-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages shadowsocks-libev depends on:
ii  libbloom1       1.5-5
ii  libc-ares2      1.14.0-1
ii  libc6           2.28-10
ii  libcap2-bin     1:2.25-2
ii  libcork16       0.15.0+ds-12
ii  libcorkipset1   1.1.1+20150311-8
ii  libev4          1:4.25-1
ii  libmbedcrypto3  2.16.0-1
ii  libpcre3        2:8.39-12
ii  libsodium23     1.0.17-1
ii  lsb-base        10.2019051400

shadowsocks-libev recommends no packages.

Versions of packages shadowsocks-libev suggests:
pn  haveged      <none>
pn  kcptun       <none>
pn  simple-obfs  <none>

-- no debconf information

[toc] | [next] | [standalone]

#1008090

Hi,

On Mon, May 04, 2020 at 09:33:09PM -0500, John Goerzen wrote:
> Package: shadowsocks-libev
> Version: 3.2.5+ds-1
> Severity: normal
> Tags: security
> 
> Per https://github.com/shadowsocks/shadowsocks-libev/blob/master/debian/changelog :
> 
> shadowsocks-libev (3.3.4-1) unstable; urgency=medium
> 
>   * Minor bug fixes. (#2539, #2565, #2566, #2577)
>   * Security bug fixes. (CVE-2019-5163, CVE-2019-5164)
> 
> It would be good to get this version, or at least these patches, into
> buster security updates.

FWIW, those were marked 'no-dsa', but a fix via an upcoming point
release would be great to have.

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web