Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5523

Re: RFC: proposed fix for CVE-2018-19518 in uw-imap

Cross-posted to 2 groups.

Show all headers | View raw

Hi Roberto,

On Sat, Dec 29, 2018 at 10:24:40AM -0500, Roberto C. Sánchez wrote:
> On Sat, Dec 22, 2018 at 10:27:18PM -0500, Roberto C. Sánchez wrote:
> > [note: I am not subscribed to debian-security; please keep me or
> > debian-lts addressed on replies]
> > 
> > If this seems like a sensible approach, I propose to apply the attached
> > patch to uw-imap 8:2007f~dfsg-5 (the current stretch/buster/sid version)
> > to create version 8:2007f~dfsg-6 for upload to sid and eventual
> > inclusion in stretch (perhaps via a point release) and then also in
> > parallel create a 8:2007f~dfsg-4+deb8u1 package for upload to jessie.
> > 
> > Please reply with your comments.  In particular, feedback from the
> > security team on the appropriateness of this for a stable point release
> > and my suggested route for the update to take to get there would be very
> > useful.
> > 
> 
> Hi all,
> 
> Since Tomas and Ola have reviewed the patch and we have had some
> discussion which makes it seem like this is the most sensible approach
> to the vulnerability given the constraints, I wonder if the Security
> team could weigh in.
> 
> I have forwarded my initial message and the patch to Magnus Holngren
> (the uw-imap maintainer) and also added him as a recipient of this
> message, as he may wish to be the one to upload to unstable and
> coordinate the future point release inclusion.
> 
> I ask for some indication now from the security team and/or the
> maintainer since I don't think it makes sense to fix this only in jessie
> and not in stretch/buster/sid.

There is an alternative approach wich was raised by Magnus in the
respective bug: https://bugs.debian.org/914632#12 (and see followup
from Moritz).

Regards,
Salvatore

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-23 04:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-24 22:50 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-26 09:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-25 12:30 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 05:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 15:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-28 19:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Ola Lundqvist <ola@inguza.com> - 2018-12-28 21:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-29 16:30 +0100
    RE: RFC: proposed fix for CVE-2018-19518 in uw-imap COSTEY Anthony <a.costey@caenlamer.fr> - 2018-12-29 17:10 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Salvatore Bonaccorso <carnil@debian.org> - 2018-12-30 09:40 +0100
      Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Magnus Holmgren <holmgren@debian.org> - 2019-02-24 20:40 +0100

csiph-web