Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet

Path	csiph.com!feeder.erje.net!2.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Niels Thykier <niels@thykier.net>
Newsgroups	linux.debian.security
Subject	Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet
Date	Mon, 08 May 2017 08:00:02 +0200
Message-ID	<tEJSa-896-5@gated-at.bofh.it> (permalink)
References	<tEJSa-896-7@gated-at.bofh.it>
X-Original-To	debian-security@lists.debian.org
X-Mailbox-Line	From debian-security-request@lists.debian.org Mon May 8 05:59:31 2017
Old-Return-Path	<niels@thykier.net>
X-Amavis-Spam-Status	No, score=-7 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FOURLA=0.1, LDO_WHITELIST=-5] autolearn=ham autolearn_force=no
Dkim-Signature	v=1; a=rsa-sha256; c=simple/simple; d=thykier.net; s=20140924; h=from:subject:date:message-id:to:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=fhAuosMowA03iCuTh4Hhmdtu7+t79Ha8I5tgr4up1IA=; b=nCRjjnm8oZEF/hbw39CUhzU4290BmxFl5Gu71YK7C/9zDYqJPji0JElF7eE4BymB4La7WQ1GpTHUL FKMIHV2HRIoqGJdCAHhMXYNlAncc0j0nEfnYXrpMg+USVbUkq8cs4vVzOYfwUX7NzXurHRk/8P6QVc 3inSzE1w3iMvO/O0=
X-Halone-Cookie	410ceafa7800eed261d2072d84f44a1abec6d147
X-Halone-ID	720e2988-33b3-11e7-a25f-b82a72d06996
X-Forwarded-Message-ID	<6101ddd5e5524b88850365f3e7508457@imshyb01.MITRE.ORG>
MIME-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	7bit
X-Mailing-List	<debian-security@lists.debian.org> archive/latest/28295
List-ID	<debian-security.lists.debian.org>
List-URL	<https://lists.debian.org/debian-security/>
List-Archive	https://lists.debian.org/msgid-search/c000feaf-e596-880e-dd3b-bfb7e4abef5e@thykier.net
Approved	robomod@news.nic.it
Lines	72
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Mon, 08 May 2017 05:58:00 +0000
X-Original-Message-ID	<c000feaf-e596-880e-dd3b-bfb7e4abef5e@thykier.net>
X-Original-References	<6101ddd5e5524b88850365f3e7508457@imshyb01.MITRE.ORG>
Xref	csiph.com linux.debian.security:5222

Show key headers only | View raw

#861958 is now known as CVE-2017-8829 per following mail from
cve-request@mitre.org.



-------- Forwarded Message --------
Subject: Re: [scr330159] lintian - 2.5.41, not fixed yet
Date: Sun, 7 May 2017 23:06:53 -0400
From: cve-request@mitre.org
To: niels@thykier.net
CC: cve-request@mitre.org

> [Suggested description]
> Deserialization vulnerability in lintian through 2.5.50.3
> allows attackers to trigger code execution by requesting a review of
> a source package with a crafted YAML file.
> 
> ------------------------------------------
> 
> [Additional Information]
> The issue is already public. It affects Debian unstable (development),
> testing (development) and stable-backports plus Ubuntu xenial,
> yakkety, zesty, artful (development). Other Debian-based distros may
> be affected as well. This product is maintained at
> https://anonscm.debian.org/cgit/lintian/lintian.git
> 
> ------------------------------------------
> 
> [VulnerabilityType Other]
> Code execution via YAML deserialization
> 
> ------------------------------------------
> 
> [Vendor of Product]
> Debian, Ubuntu
> 
> ------------------------------------------
> 
> [Affected Product Code Base]
> lintian - 2.5.41, not fixed yet
> 
> ------------------------------------------
> 
> [Attack Type Other]
> Needs to make victim run lintian on source package with crafted YAML file
> 
> ------------------------------------------
> 
> [Impact Code execution]
> true
> 
> ------------------------------------------
> 
> [Attack Vectors]
> Needs to make victim run lintian on source package with crafted YAML file
> 
> ------------------------------------------
> 
> [Reference]
> https://bugs.debian.org/861958
> 
> ------------------------------------------
> 
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
> 
> ------------------------------------------
> 
> [Discoverer]
> Jakub Wilk (Debian)

Use CVE-2017-8829.

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet Niels Thykier <niels@thykier.net> - 2017-05-08 08:00 +0200
  Re: Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-05-08 22:50 +0200

csiph-web