Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #910995
| From | Ferenc Wágner <wferi@debian.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#905332: src:xml-security-c: Default KeyInfo resolver doesn't check for empty element content |
| Date | 2018-08-03 10:30 +0200 |
| Message-ID | <wiDDb-1AH-3@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
Package: src:xml-security-c Severity: important Tags: security This is a security tracking bug. Original report: https://issues.apache.org/jira/projects/SANTUARIO/issues/SANTUARIO-491 The issue is null pointer dereference in the library, which happens to mean a trivial remote DoS (shibd crash) in the Shibboleth SP stack. I requested a CVE from Mitre, but haven't got it yet. The stretch security upload is ready, I'm sending the debdiff. All version in the archive are affected, the upstream fix is in 2.0.1, which will be uploaded to experimental shortly.
Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread
Bug#905332: src:xml-security-c: Default KeyInfo resolver doesn't check for empty element content Ferenc Wágner <wferi@debian.org> - 2018-08-03 10:30 +0200
Bug#905332: debdiff wferi@niif.hu (Ferenc Wágner) - 2018-08-03 12:10 +0200
Bug#905332: debdiff Moritz Mühlenhoff <jmm@inutil.org> - 2018-08-03 13:10 +0200
Bug#905332: debdiff wferi@niif.hu (Ferenc Wágner) - 2018-08-03 14:50 +0200
csiph-web