Debian Bug report logs -
#963147
ngircd: CVE-2020-14148
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Fri, 19 Jun 2020 17:09:02 UTC
Severity: important
Tags: confirmed, patch, pending, security, upstream
Found in versions ngircd/25-3, ngircd/25-2
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Christoph Biedl <debian.axhn@manchmal.in-ulm.de>:
Bug#963147; Package src:ngircd.
(Fri, 19 Jun 2020 17:09:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Christoph Biedl <debian.axhn@manchmal.in-ulm.de>.
(Fri, 19 Jun 2020 17:09:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: ngircd
Version: 25-3
Severity: important
Tags: security upstream
Control: found -1 25-2
Hi,
The following vulnerability was published for ngircd.
CVE-2020-14148[0]:
| The Server-Server protocol implementation in ngIRCd before 26~rc2
| allows an out-of-bounds access, as demonstrated by the IRC_NJOIN()
| function.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-14148
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14148
[1] https://github.com/ngircd/ngircd/issues/274
[2] https://github.com/ngircd/ngircd/issues/277
[3] https://github.com/ngircd/ngircd/pull/275
[4] https://github.com/ngircd/ngircd/pull/276
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Marked as found in versions ngircd/25-2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Fri, 19 Jun 2020 17:09:03 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Christoph Biedl <debian.axhn@manchmal.in-ulm.de>:
Bug#963147; Package src:ngircd.
(Fri, 19 Jun 2020 18:12:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Hilko Bengen <bengen@debian.org>:
Extra info received and forwarded to list. Copy sent to Christoph Biedl <debian.axhn@manchmal.in-ulm.de>.
(Fri, 19 Jun 2020 18:12:02 GMT) (full text, mbox, link).
Message #12 received at 963147@bugs.debian.org (full text, mbox, reply):
control: tag -1 patch
Good news: Upstream commit f6f5ec4cd5c3c3e38a3a1ae4e6ec249594ad159c
which fixes the underlying issue will fit onto both version 24 and 25
without further porting.
Cheers,
-Hilko
Added tag(s) patch.
Request was from Hilko Bengen <bengen@debian.org>
to 963147-submit@bugs.debian.org.
(Fri, 19 Jun 2020 18:12:02 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Christoph Biedl <debian.axhn@manchmal.in-ulm.de>:
Bug#963147; Package src:ngircd.
(Fri, 19 Jun 2020 19:15:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Hilko Bengen <bengen@debian.org>:
Extra info received and forwarded to list. Copy sent to Christoph Biedl <debian.axhn@manchmal.in-ulm.de>.
(Fri, 19 Jun 2020 19:15:03 GMT) (full text, mbox, link).
Message #19 received at 963147@bugs.debian.org (full text, mbox, reply):
* Hilko Bengen:
> Good news: Upstream commit f6f5ec4cd5c3c3e38a3a1ae4e6ec249594ad159c
> which fixes the underlying issue will fit onto both version 24 and 25
> without further porting.
That should have been 02cf31c0e267a4c9a7656d43ad3ad4eeb37fc9c5.
Specifically:
commit 02cf31c0e267a4c9a7656d43ad3ad4eeb37fc9c5
Author: Alexander Barton <alex@barton.de>
Date: Mon May 25 23:43:29 2020 +0200
Sorry for any confusion.
-Hilko
Added tag(s) confirmed and pending.
Request was from Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
to control@bugs.debian.org.
(Fri, 19 Jun 2020 19:57:03 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Sat Jun 20 13:40:23 2020;
Machine Name:
bembo
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon