Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5619 > unrolled thread
| Started by | Vladyslav Cherednychenko <vladyslav.cherednychenko@aboutyou.com> |
|---|---|
| First post | 2019-07-11 17:40 +0200 |
| Last post | 2019-07-16 22:10 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.security
CVE-2017-9525 in Debian Stretch stable release Vladyslav Cherednychenko <vladyslav.cherednychenko@aboutyou.com> - 2019-07-11 17:40 +0200
Re: CVE-2017-9525 in Debian Stretch stable release Salvatore Bonaccorso <carnil@debian.org> - 2019-07-16 22:10 +0200
| From | Vladyslav Cherednychenko <vladyslav.cherednychenko@aboutyou.com> |
|---|---|
| Date | 2019-07-11 17:40 +0200 |
| Subject | CVE-2017-9525 in Debian Stretch stable release |
| Message-ID | <yiJkS-7IY-9@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Dear Debian Security Team, I noticed that the latest available cron package in the stable distribution of Debian Stretch is vulnerable to CVE-2017-9525: https://security-tracker.debian.org/tracker/CVE-2017-9525 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864466 It seems like this issue has been known for a while now and fixed. Are there plans to include cron version 3.0pl1-129 to the stable release of Debian Stretch? Regards, Vladyslav Cherednychenko Information Security Engineer ABOUT YOU° GmbH Domstraße 10 20095 Hamburg Email: vladyslav.cherednychenko@aboutyou.de Phone: +49 40 638 569 313 www.aboutyou.de
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2019-07-16 22:10 +0200 |
| Message-ID | <ykBVT-4k7-3@gated-at.bofh.it> |
| In reply to | #5619 |
Hi, On Thu, Jul 11, 2019 at 05:21:38PM +0200, Vladyslav Cherednychenko wrote: > Dear Debian Security Team, > I noticed that the latest available cron package in the stable > distribution of Debian Stretch is vulnerable to CVE-2017-9525: > https://security-tracker.debian.org/tracker/CVE-2017-9525 > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864466 > > It seems like this issue has been known for a while now and fixed. > Are there plans to include cron version 3.0pl1-129 to the stable > release of Debian Stretch? There are currently no plans to update the cron package to adress this issue only. The issue is severity wise minor, and would not warrant a DSA on its own. It can be fixed in a point release, but ideally picking up other src:cron issues which are open for stretch in a point release. Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web