CVE-2015-5313: storage: don't allow '/' in filesystem volume names

Related Vulnerabilities: CVE-2015-5313  

Debian Bug report logs - #808273
CVE-2015-5313: storage: don't allow '/' in filesystem volume names

version graph

Reported by: Guido Günther <agx@sigxcpu.org>

Date: Fri, 18 Dec 2015 08:36:01 UTC

Severity: important

Tags: fixed-upstream, security, upstream

Found in version libvirt/1.1.0-1

Fixed in version libvirt/1.3.0-1

Done: Guido Günther <agx@sigxcpu.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian Libvirt Maintainers <pkg-libvirt-maintainers@lists.alioth.debian.org>:
Bug#808273; Package src:libvirt. (Fri, 18 Dec 2015 08:36:05 GMT) (full text, mbox, link).


Acknowledgement sent to Guido Günther <agx@sigxcpu.org>:
New Bug report received and forwarded. Copy sent to Debian Libvirt Maintainers <pkg-libvirt-maintainers@lists.alioth.debian.org>. (Fri, 18 Dec 2015 08:36:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2015-5313: storage: don't allow '/' in filesystem volume names
Date: Fri, 18 Dec 2015 09:34:04 +0100
Source: libvirt
Version: 1.3.0-1
Severity: important

Hi,

see

https://libvirt.org/git/?p=libvirt.git;a=commit;h=034e47c338b13a95cf02106a3af912c1c5f818d7

we have ACLs disabled by default so the default configuration is not
affected.
Cheers,
 -- Guido

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable-updates'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.1.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)



Reply sent to Guido Günther <agx@sigxcpu.org>:
You have taken responsibility. (Fri, 18 Dec 2015 08:45:11 GMT) (full text, mbox, link).


Notification sent to Guido Günther <agx@sigxcpu.org>:
Bug acknowledged by developer. (Fri, 18 Dec 2015 08:45:11 GMT) (full text, mbox, link).


Message #10 received at 808273-done@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>
To: 808273-done@bugs.debian.org
Subject: Fixed in recent upload
Date: Fri, 18 Dec 2015 09:42:33 +0100
Version: libvirt/1.3.0-1

Cheers,
 -- Guido



No longer marked as found in versions libvirt/1.3.0-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 18 Dec 2015 13:21:09 GMT) (full text, mbox, link).


Marked as fixed in versions libvirt/1.3.0-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 18 Dec 2015 13:21:10 GMT) (full text, mbox, link).


Marked as found in versions libvirt/1.1.0-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 18 Dec 2015 13:21:11 GMT) (full text, mbox, link).


Added tag(s) security, fixed-upstream, and upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 18 Dec 2015 13:33:15 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 25 Feb 2016 07:34:24 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:47:27 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.