Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4511 > unrolled thread

Re: [SECURITY] [DSA 3455-1] curl security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3455-1] curl security update Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 10:50 +0100
    Re: [SECURITY] [DSA 3455-1] curl security update Freddy Spierenburg <freddy@snarl.nl> - 2016-02-02 11:10 +0100
      Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl  security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 16:40 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 17:20 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 17:30 +0100
            Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update) Holger Levsen <holger@layer-acht.org> - 2016-02-02 18:20 +0100
            Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Sébastien NOBILI <sebnewsletter@free.fr> - 2016-02-02 18:50 +0100
            Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 22:30 +0100
              Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 23:10 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Marc Haber <mh+debian-security@zugschlus.de> - 2016-02-02 18:00 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Lupe Christoph <lupe@lupe-christoph.de> - 2016-02-02 18:10 +0100
          Re: Security support incomplete? "Pedro M. Jorge" <pmjorge@lip.pt> - 2016-02-02 18:50 +0100
            Re: Security support incomplete? Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 19:10 +0100

#4511 — Re: [SECURITY] [DSA 3455-1] curl security update

Hi,

I notice that there are no fixes for oldstable. Is oldstable not
affected by this security issue?

All the best,
Wolfgang

Am Mittwoch, den 27.01.2016, 12:16 +0000 schrieb Alessandro Ghedini:
> -------------------------------------------------------------------------
> Debian Security Advisory DSA-3455-1                   security@debian.org
> https://www.debian.org/security/                       Alessandro Ghedini
> January 27, 2016                      https://www.debian.org/security/faq
> -------------------------------------------------------------------------
> 
> Package        : curl
> CVE ID         : CVE-2016-0755
> 
> Isaac Boukris discovered that cURL, an URL transfer library, reused
> NTLM-authenticated proxy connections without properly making sure that
> the connection was authenticated with the same credentials as set for
> the new transfer. This could lead to HTTP requests being sent over the
> connection authenticated as a different user.
> 
> For the stable distribution (jessie), this problem has been fixed in
> version 7.38.0-4+deb8u3.
> 
> For the unstable distribution (sid), this problem has been fixed in
> version 7.47.0-1.
> 
> We recommend that you upgrade your curl packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
> 
> Mailing list: debian-security-announce@lists.debian.org

[toc] | [next] | [standalone]

#4512

[Multipart message — attachments visible in raw view] — view raw

Hi Wolfgang,

On Tue, Feb 02, 2016 at 11:40:03AM +0200, Wolfgang Jeltsch wrote:
> I notice that there are no fixes for oldstable. Is oldstable not
> affected by this security issue?
[cut]
> > Package        : curl
> > CVE ID         : CVE-2016-0755

Please check out: https://security-tracker.debian.org/tracker/CVE-2016-0755


-- 
$ cat ~/.signature
Freddy Spierenburg <freddy@snarl.nl>         http://freddy.snarl.nl/
GnuPG: 0x9218273E=C71E F201 840C 8998 4D3F  F675 B507 BF7D 9218 273E
$ # Please read http://www.ietf.org/rfc/rfc2015.txt before complain!

[toc] | [prev] | [next] | [standalone]

#4513 — Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

Am Dienstag, den 02.02.2016, 10:58 +0100 schrieb Freddy Spierenburg:
> Hi Wolfgang,
> 
> On Tue, Feb 02, 2016 at 11:40:03AM +0200, Wolfgang Jeltsch wrote:
> > I notice that there are no fixes for oldstable. Is oldstable not
> > affected by this security issue?
> [cut]
> > > Package        : curl
> > > CVE ID         : CVE-2016-0755
> 
> Please check out: https://security-tracker.debian.org/tracker/CVE-2016-0755

Hi,

so as I understand, this security hole will not be fixed in oldstable.

While I can understand that this might be a sensible decision, I wonder
why this is not announced prominently. I understood that oldstable has
security support, meaning that all known security holes in it will be
fixed by default. There have been cases when the security team stopped
supporting certain packages in oldstable, but where this was clearly
announced.

So far I relied on the assumption that I am on the safe side if I
regularly install all available security updates and watch out for
announcements of discontinuation of security support. Now I wonder how
many security holes my system already has, because issues have gone
silently unfixed.

Can anyone please clarify? In particular, I would like to know what the
exact policies regarding coverage of security support are, and what
issues have not been fixed intentionally in oldstable (and maybe even
stable).

Thank you very much.

All the best,
Wolfgang

[toc] | [prev] | [next] | [standalone]

#4514 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

[Multipart message — attachments visible in raw view] — view raw

On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
> Can anyone please clarify? In particular, I would like to know what the
> exact policies regarding coverage of security support are, and what
> issues have not been fixed intentionally in oldstable (and maybe even
> stable).

Everything is in the tracker.

Regards,
-- 
Yves-Alexis

[toc] | [prev] | [next] | [standalone]

#4515 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

Am Dienstag, den 02.02.2016, 17:14 +0100 schrieb Yves-Alexis Perez:
> On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
> > Can anyone please clarify? In particular, I would like to know what the
> > exact policies regarding coverage of security support are, and what
> > issues have not been fixed intentionally in oldstable (and maybe even
> > stable).
> 
> Everything is in the tracker.

Hi,

could someone maybe give me a more specific answer?

  • Where does the tracker talk about security policies? (I actually
    doubt that such information is in the tracker at all.)

  • Where is a list of unfixed security issues?

URLs would be highly appreciated.

Please not that while such brief answers as above might be appropriate
for developers, they are typically not very helpful for users.

All the best,
Wolfgang

[toc] | [prev] | [next] | [standalone]

#4518 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

[Multipart message — attachments visible in raw view] — view raw

Hi Wolfgang,

On Dienstag, 2. Februar 2016, Wolfgang Jeltsch wrote:
>   • Where does the tracker talk about security policies? (I actually
>     doubt that such information is in the tracker at all.)

That's out of scope for the tracker indeed, however right now I dont know 
where to find such policies.

>   • Where is a list of unfixed security issues?

https://security-tracker.debian.org/tracker/ links to filters for the 
different suites, eg "Vulnerable packages in the stable suite" points to 
https://security-tracker.debian.org/tracker/status/release/stable where you 
can tune your view.

So https://security-
tracker.debian.org/tracker/status/release/stable?filter=1&filter=high_urgency&filter=medium_urgency&filter=low_urgency&filter=unimportant_urgency&filter=unassigned_urgency&filter=undetermined_issues&filter=nodsa 
is probably the URL which will show you the highest number of security issues 
in stable ;)
 
> URLs would be highly appreciated.

not directly answering your questions, but maybe still useful:

http://security-team.debian.org/security_tracker.html


cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#4520 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

Hi,

Le mardi 02 février 2016 à 18:21, Wolfgang Jeltsch a écrit :
>   • Where is a list of unfixed security issues?

"debsecan" package might be an option for getting such a list. I don't have an
oldstable install to check if this particular issue is in the list. Maybe
someone else could check for it?

Sébastien

[toc] | [prev] | [next] | [standalone]

#4522 — Re: Security support incomplete?

On 02/02/2016 17:21, Wolfgang Jeltsch wrote:

>    • Where is a list of unfixed security issues?

You can know security issues of potentially security issues on packages 
you have installed on your system:

1) you can list installed package with open security issues
# apt-get install debsecan

$ debsecan


2) You can know package that can have bugs, but that these bugs will not 
be fixed because there is only a partial security support or there isn't 
a security support.

# apt-get install debian-security-support

$ check-support-status

When you upgrade your system or you install new packages you will have a 
report if there is one or more packages without or limited security support

So with this you can know packages with potentially unfixed bugs.

Ciao
Davide

-- 
Dizionari: http://linguistico.sourceforge.net/wiki
Esci dall'illegalità: utilizza LibreOffice/OpenOffice:
http://linguistico.sf.net/wiki/doku.php?id=usaooo
Non autorizzo la memorizzazione del mio indirizzo su outlook

[toc] | [prev] | [next] | [standalone]

#4524 — Re: Security support incomplete?

On 02/02/2016 22:29, Davide Prina wrote:
> On 02/02/2016 17:21, Wolfgang Jeltsch wrote:
>
>>    • Where is a list of unfixed security issues?
>
> You can know security issues of potentially security issues on packages
> you have installed on your system:
>
> 1) you can list installed package with open security issues
> # apt-get install debsecan
>
> $ debsecan
>
>
> 2) You can know package that can have bugs, but that these bugs will not
> be fixed because there is only a partial security support or there isn't
> a security support.
>
> # apt-get install debian-security-support
>
> $ check-support-status
>

3) you can know installed package that is not into Debian repository, so 
they can have bug not fixed

# apt-get install apt-show-versions

$ apt-show-versions | grep "No availab"


Ciao
Davide

-- 
Dizionari: http://linguistico.sourceforge.net/wiki
Database: http://www.postgresql.org
GNU/Linux User: 302090: http://counter.li.org
Non autorizzo la memorizzazione del mio indirizzo su outlook

[toc] | [prev] | [next] | [standalone]

#4516 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

On Tue, Feb 02, 2016 at 05:14:42PM +0100, Yves-Alexis Perez wrote:
> On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
> > Can anyone please clarify? In particular, I would like to know what the
> > exact policies regarding coverage of security support are, and what
> > issues have not been fixed intentionally in oldstable (and maybe even
> > stable).
> 
> Everything is in the tracker.

This answer is not helpful at all. Wolfgang has made clear that he
didn't fully grasp the - terse - information that can be found in the
tracker. It does NOT help at all just to point him again towards the
source that he hasn't understood.

Just for the record, I as well don't fully grasp the information that
can be found in the tracker, I concur with his interpretation and I am
equally disturbed by this interpretation.

Greetings
Marc


-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

[toc] | [prev] | [next] | [standalone]

#4517 — Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

On Tuesday, 2016-02-02 at 17:14:42 +0100, Yves-Alexis Perez wrote:
> On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
> > Can anyone please clarify? In particular, I would like to know what the
> > exact policies regarding coverage of security support are, and what
> > issues have not been fixed intentionally in oldstable (and maybe even
> > stable).

> Everything is in the tracker.

This is three-fold: the DSA does not mention oldstable at all, the DSA
does not link to the tracker, and the text in the tracker page does not
really justify the decision to leave oldstable unfixed "Too intrusive
to backport". What?!? The link with that text points to a page that does
nothing to explain the decision.

Lupe Christoph
-- 
| As everyone knows, it was predicted that the world would end last       |
| Wednesday at 10:00 PST.  Since there appears to be a world in existence |
| now, the entire universe must therefore have been recreated, complete   |
| with an apparent "history", last *Thursday*.  QED.                      |
| Seanna Watson, <1992Nov2.165142.11847@bcrka451.bnr.ca>                  |

[toc] | [prev] | [next] | [standalone]

#4519 — Re: Security support incomplete?

On 2016-02-02 16:14, Yves-Alexis Perez wrote:
> On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
>> Can anyone please clarify? In particular, I would like to know what 
>> the
>> exact policies regarding coverage of security support are, and what
>> issues have not been fixed intentionally in oldstable (and maybe even
>> stable).
> 
> Everything is in the tracker.
> 
> Regards,

Hi,

Even the tracker has its issues.

Looking at the DSA in the announcement
https://security-tracker.debian.org/tracker/DSA-3455-1
"Debian/oldstable	not known to be vulnerable."
but looking at the matching CVE
https://security-tracker.debian.org/tracker/CVE-2016-0755
"Debian/oldstable	package curl is vulnerable."

Pointing me to the tracker just brought me the unpleasant news that I 
was already vulnerable to the older
https://security-tracker.debian.org/tracker/CVE-2015-3153
"Debian/oldstable	package curl is vulnerable."
https://security-tracker.debian.org/tracker/DSA-3240-1
"Debian/oldstable	not known to be vulnerable."

Thanks for the work, anyway.

Pedro.

[toc] | [prev] | [next] | [standalone]

#4521 — Re: Security support incomplete?

[Multipart message — attachments visible in raw view] — view raw

On mar., 2016-02-02 at 17:36 +0000, Pedro M. Jorge wrote:
> Even the tracker has its issues.

The tracker is (more or less) live data, so it's giving the current state of
information the security team (and all interested contributors actually) has. 

The DSA is more static, and represent the view at the time the DSA mail was
sent.

All in all, it depends on what information you're interested in…
-- 
Yves-Alexis

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web