Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1024950 > unrolled thread

Bug#970252: CVE-2020-14004

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#970252: CVE-2020-14004 Moritz Muehlenhoff <jmm@debian.org> - 2020-09-13 22:50 +0200
    Bug#970252: [Pkg-nagios-devel] Bug#970252: Bug#970252: CVE-2020-14004 Salvatore Bonaccorso <carnil@debian.org> - 2020-09-15 07:00 +0200

#1024950 — Bug#970252: CVE-2020-14004

Package: icinga2
Severity: important
Tags: security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Please see https://www.openwall.com/lists/oss-security/2020/06/12/1

Cheers,
        Moritz

[toc] | [next] | [standalone]

#1025125 — Bug#970252: [Pkg-nagios-devel] Bug#970252: Bug#970252: CVE-2020-14004

Hi Sebastiaan,

On Mon, Sep 14, 2020 at 07:09:05AM +0200, Sebastiaan Couwenberg wrote:
> On 9/14/20 6:38 AM, Sebastiaan Couwenberg wrote:
> > On 9/14/20 5:41 AM, Sebastiaan Couwenberg wrote:
> >> On 9/13/20 10:39 PM, Moritz Muehlenhoff wrote:
> >>> Please see https://www.openwall.com/lists/oss-security/2020/06/12/1
> >>
> >> This is fixed upstream in:
> >>
> >>  v2.12.0 v2.11.5 v2.11.4
> >>
> >> The former is already in experimental, and the 2.11 package in unstable
> >> will be updated to .5 to have the fix as well.
> > 
> > icinga2 (2.11.5-1) has been uploaded to unstable.
> 
> The update for buster is also available:
> 
>  https://salsa.debian.org/nagios-team/pkg-icinga2/-/commits/buster
> 
> Is it alright to upload the -sa build to security-master?

This is likely a no-dsa candidate, but can you fix the issue via the
upcoming point release?

The window for uploads should be closing the upcoming weekend for
inclusion in 10.6.

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web