quassel: Incomplete fix for CVE-2013-4422

Debian Bug report logs - #783926
quassel: Incomplete fix for CVE-2013-4422

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: quassel: Incomplete fix for CVE-2013-4422

Date: Fri, 01 May 2015 12:45:32 +0200

Source: quassel
Version: 1:0.10.0-2.3
Severity: important
Tags: security patch upstream fixed-upstream

Hi,

the following vulnerability was published for quassel.

CVE-2015-3427[0]:
Incomplete fix for CVE-2013-4422

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-3427

Regards,
Salvatore

Message #10 received at 783926@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: 783926@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: quassel: diff for NMU version 1:0.10.0-2.4

Date: Tue, 5 May 2015 17:22:55 +0200

[Message part 1 (text/plain, inline)]

Control: tags 783926 + pending

Dear maintainer,

I've prepared an NMU for quassel (versioned as 1:0.10.0-2.4) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards,
Felix

[quassel-0.10.0-2.4-nmu.diff (text/x-diff, attachment)]

Message #17 received at 783926-close@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: 783926-close@bugs.debian.org

Subject: Bug#783926: fixed in quassel 1:0.10.0-2.4

Date: Thu, 07 May 2015 19:58:28 +0000

Source: quassel
Source-Version: 1:0.10.0-2.4

We believe that the bug you reported is fixed in the latest version of
quassel, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 783926@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Felix Geyer <fgeyer@debian.org> (supplier of updated quassel package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 05 May 2015 16:48:57 +0200
Source: quassel
Binary: quassel-core quassel-client quassel quassel-data quassel-client-kde4 quassel-kde4 quassel-data-kde4
Architecture: source all
Version: 1:0.10.0-2.4
Distribution: unstable
Urgency: high
Maintainer: Thomas Mueller <thomas.mueller@tmit.eu>
Changed-By: Felix Geyer <fgeyer@debian.org>
Description:
 quassel    - distributed IRC client - Qt-based monolithic core+client
 quassel-client - distributed IRC client - Qt-based client component
 quassel-client-kde4 - distributed IRC client - KDE-based client
 quassel-core - distributed IRC client - core component
 quassel-data - distributed IRC client - shared data (Qt version)
 quassel-data-kde4 - distributed IRC client - shared data (KDE4 version)
 quassel-kde4 - distributed IRC client - KDE-based monolithic core+client
Closes: 783926
Changes:
 quassel (1:0.10.0-2.4) unstable; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2015-3427: SQL injection vulnerability in PostgreSQL backend.
     (Closes: #783926)
     - Add debian/patches/CVE-2015-3427.patch, cherry-picked from upstream.
     - The original issue was CVE-2013-4422 which had an incomplete fix.
Checksums-Sha1:
 a0dfbc767bb050febd93ef2feb6a5577ebfd3469 2358 quassel_0.10.0-2.4.dsc
 81fb4e38929584ce267a1cae9801cd548bf40a1a 22632 quassel_0.10.0-2.4.debian.tar.xz
 6d1a1fbbf4467adc17863b202baf475df4a63991 22928 quassel-data_0.10.0-2.4_all.deb
 e4bc9413eb19c4486b684701c5018729b618256b 623046 quassel-data-kde4_0.10.0-2.4_all.deb
Checksums-Sha256:
 b5e55b5c3446fb039799af4cb25010002793edb19a69df075eeff21cd40813e7 2358 quassel_0.10.0-2.4.dsc
 593fc7fe2bf724a5fe8da28097bd035a8813e625ed3a80bf4551d9cc5c06caed 22632 quassel_0.10.0-2.4.debian.tar.xz
 b745beef49a91ef62fa4af2d53d8685fc8ea79493cb2657490125fcc372c1c21 22928 quassel-data_0.10.0-2.4_all.deb
 4ebcd7d3b4de8fed7e9c8c89aaee775cc1b156a149b85ab2d4814058dd0f259d 623046 quassel-data-kde4_0.10.0-2.4_all.deb
Files:
 03f85062d573f86f79adcf29544e8cc7 2358 net optional quassel_0.10.0-2.4.dsc
 68d90467e6cba6eb62ea4f726c0e93af 22632 net optional quassel_0.10.0-2.4.debian.tar.xz
 72aaa2cc406f32440030236596c23a35 22928 net optional quassel-data_0.10.0-2.4_all.deb
 5fc11344d29f0eced7900bcf746c24cd 623046 net optional quassel-data-kde4_0.10.0-2.4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJVSN+sAAoJEP4ixv2DE11FSYAQAKHH02Oj3ovHK/qnqUQ0JDSw
Uxe5L6tzUili1tTcD7cthkIi7V9r73l9GoG5347+31VbIdugUYjXs4sOB1u+NIk1
D0ziD9+nUeK/MmkVWw5KwNZvMedazwfsRfhY7ZyXCe8bUTIP/AL5JVVYHep4z1nl
WcVXEv408itbxgpX6akeVbk9nHYygTh+z1DtWyBILF8bHhjQX9nmZ0EXN9Yterh/
3tv0fkO8oKUx9cU1DvWwNU0ZIFf8nLJs9rc9ve7raQIEt5/5BjtQXvHroY5XoTQH
DDRdnTehvrBnX0pzoo20eRbSu+3JJavj6YvRdgXMRiY4igotxUqE+oM3ZmT0QUqm
BiQHBMQIWNAPj+8i9G3se+5tiC6GfdM5GeBqlUVuDi9x9TZ/n6N45osXvfNr9R2A
tCnPx5STQq4EebHEN+w0sb+DMskWgsp+z/l3eHuTeOOWPQYQyidmgsXr7xiCW9HK
QKL6nSeYpXCM3cUqA6sHh4tHM80dPovAiqlu1wDFvMCvslSc6bQzXwIq5afXmk5b
A4rskYPnpRN3VX9VtIiNdStBqfsDpesvRfPRU5cQ8RmXPaluzIkCoqaNgRSlazJl
goZpgI55uswVouNBX6dPhEfabimun9gYJO18XJdlLdzkpsRtlHv4VsOPVapnTMb2
x65SAw6kiq4XpkjDsXLX
=wnuA
-----END PGP SIGNATURE-----

Message #22 received at 783926@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 783926@bugs.debian.org

Subject: Re: quassel: Incomplete fix for CVE-2013-4422

Date: Fri, 08 May 2015 19:11:17 +0200

Hi,

On Fri, 01 May 2015 12:45:32 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
> Source: quassel
> Version: 1:0.10.0-2.3
> Severity: important
> Tags: security patch upstream fixed-upstream
> 
> Hi,
> 
> the following vulnerability was published for quassel.
> 
> CVE-2015-3427[0]:
> Incomplete fix for CVE-2013-4422

I have uploaded a fix to unstable.
Can I upload the same to security-master for jessie-security
(different changelog entry obviously)?

Cheers,
Felix

Message #27 received at 783926@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Felix Geyer <fgeyer@debian.org>, 783926@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#783926: quassel: Incomplete fix for CVE-2013-4422

Date: Sat, 9 May 2015 07:37:52 +0200

[Message part 1 (text/plain, inline)]

Hi Felix,

On Fri, May 08, 2015 at 07:11:17PM +0200, Felix Geyer wrote:
> Hi,
> 
> On Fri, 01 May 2015 12:45:32 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Source: quassel
> > Version: 1:0.10.0-2.3
> > Severity: important
> > Tags: security patch upstream fixed-upstream
> > 
> > Hi,
> > 
> > the following vulnerability was published for quassel.
> > 
> > CVE-2015-3427[0]:
> > Incomplete fix for CVE-2013-4422
> 
> I have uploaded a fix to unstable.
> Can I upload the same to security-master for jessie-security
> (different changelog entry obviously)?

Thanks for working on this update. The debdiff for unstable looks good
to me. Yes, please upload as well for jessie-security (distribution
jessie-security, version set to 1:0.10.0-2.3+deb8u1). Make sure to
build with -sa though, since quassel is new to dak on security-master
so need to include original source.

Regards,
Salvatore

p.s.: for future requests, could you please as well Cc the security team
      alias, so that it can be picked up and answered by someone who has
      currently resource to handle that particular request.

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 783926@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 783926@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#783926: quassel: Incomplete fix for CVE-2013-4422

Date: Sun, 10 May 2015 20:10:29 +0200

[Message part 1 (text/plain, inline)]

Hi,

On 09.05.2015 07:37, Salvatore Bonaccorso wrote:
> Hi Felix,
> 
> On Fri, May 08, 2015 at 07:11:17PM +0200, Felix Geyer wrote:
>> Hi,
>>
>> On Fri, 01 May 2015 12:45:32 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
>>> Source: quassel
>>> Version: 1:0.10.0-2.3
>>> Severity: important
>>> Tags: security patch upstream fixed-upstream
>>>
>>> Hi,
>>>
>>> the following vulnerability was published for quassel.
>>>
>>> CVE-2015-3427[0]:
>>> Incomplete fix for CVE-2013-4422
>>
>> I have uploaded a fix to unstable.
>> Can I upload the same to security-master for jessie-security
>> (different changelog entry obviously)?
> 
> Thanks for working on this update. The debdiff for unstable looks good
> to me. Yes, please upload as well for jessie-security (distribution
> jessie-security, version set to 1:0.10.0-2.3+deb8u1). Make sure to
> build with -sa though, since quassel is new to dak on security-master
> so need to include original source.

I have uploaded it to jessie-security now.

> Regards,
> Salvatore
> 
> p.s.: for future requests, could you please as well Cc the security team
>       alias, so that it can be picked up and answered by someone who has
>       currently resource to handle that particular request.

Sure, will do next time.

Cheers,
Felix

[signature.asc (application/pgp-signature, attachment)]

Message #37 received at 783926@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Felix Geyer <fgeyer@debian.org>

Cc: 783926@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#783926: quassel: Incomplete fix for CVE-2013-4422

Date: Mon, 11 May 2015 06:40:52 +0200

[Message part 1 (text/plain, inline)]

Hi Felix,

On Sun, May 10, 2015 at 08:10:29PM +0200, Felix Geyer wrote:
> Hi,
> 
> On 09.05.2015 07:37, Salvatore Bonaccorso wrote:
> > Hi Felix,
> > 
> > On Fri, May 08, 2015 at 07:11:17PM +0200, Felix Geyer wrote:
> >> Hi,
> >>
> >> On Fri, 01 May 2015 12:45:32 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
> >>> Source: quassel
> >>> Version: 1:0.10.0-2.3
> >>> Severity: important
> >>> Tags: security patch upstream fixed-upstream
> >>>
> >>> Hi,
> >>>
> >>> the following vulnerability was published for quassel.
> >>>
> >>> CVE-2015-3427[0]:
> >>> Incomplete fix for CVE-2013-4422
> >>
> >> I have uploaded a fix to unstable.
> >> Can I upload the same to security-master for jessie-security
> >> (different changelog entry obviously)?
> > 
> > Thanks for working on this update. The debdiff for unstable looks good
> > to me. Yes, please upload as well for jessie-security (distribution
> > jessie-security, version set to 1:0.10.0-2.3+deb8u1). Make sure to
> > build with -sa though, since quassel is new to dak on security-master
> > so need to include original source.
> 
> I have uploaded it to jessie-security now.

Thank you, the upload was accepted and builds comming in.

Regards,
Salvatore

[signature.asc (application/pgp-signature, inline)]

Message #42 received at 783926-close@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: 783926-close@bugs.debian.org

Subject: Bug#783926: fixed in quassel 1:0.10.0-2.3+deb8u1

Date: Sat, 16 May 2015 06:03:00 +0000

Source: quassel
Source-Version: 1:0.10.0-2.3+deb8u1

We believe that the bug you reported is fixed in the latest version of
quassel, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 783926@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Felix Geyer <fgeyer@debian.org> (supplier of updated quassel package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 10 May 2015 16:41:30 +0200
Source: quassel
Binary: quassel-core quassel-client quassel quassel-data quassel-client-kde4 quassel-kde4 quassel-data-kde4
Architecture: source amd64 all
Version: 1:0.10.0-2.3+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Thomas Mueller <thomas.mueller@tmit.eu>
Changed-By: Felix Geyer <fgeyer@debian.org>
Description:
 quassel    - distributed IRC client - Qt-based monolithic core+client
 quassel-client - distributed IRC client - Qt-based client component
 quassel-client-kde4 - distributed IRC client - KDE-based client
 quassel-core - distributed IRC client - core component
 quassel-data - distributed IRC client - shared data (Qt version)
 quassel-data-kde4 - distributed IRC client - shared data (KDE4 version)
 quassel-kde4 - distributed IRC client - KDE-based monolithic core+client
Closes: 783926
Changes:
 quassel (1:0.10.0-2.3+deb8u1) jessie-security; urgency=high
 .
   * Fix CVE-2015-3427: SQL injection vulnerability in PostgreSQL backend.
     (Closes: #783926)
     - Add debian/patches/CVE-2015-3427.patch, cherry-picked from upstream.
     - The original issue was CVE-2013-4422 which had an incomplete fix.
Checksums-Sha1:
 97dc462a38f5afe2ee40ba9ea1c5f1cfbe0305b2 2386 quassel_0.10.0-2.3+deb8u1.dsc
 305d56774b1af2a891775a5637174d9048d875a7 2873233 quassel_0.10.0.orig.tar.bz2
 45b85dcf01d3916016c0b15aac6927d53f53993d 22704 quassel_0.10.0-2.3+deb8u1.debian.tar.xz
 6b4d3f4a2df4e2e3fe95a6207077ed173a6cbf29 1646958 quassel-core_0.10.0-2.3+deb8u1_amd64.deb
 e4b0f176b2e56e10ccba05612073cd4dc36caa9f 2438518 quassel-client_0.10.0-2.3+deb8u1_amd64.deb
 749d6341e75dfb89c1ec8384668c3bfe351270df 2849324 quassel_0.10.0-2.3+deb8u1_amd64.deb
 a9cbbdef40217aef0a1a6f0f0d58a8ca1c635f41 22954 quassel-data_0.10.0-2.3+deb8u1_all.deb
 0ca6ad22b3492ef1faa3cdb46e0f3421f90506ee 837076 quassel-client-kde4_0.10.0-2.3+deb8u1_amd64.deb
 087fc90daa18f30f35291479054d989929c3222a 1076750 quassel-kde4_0.10.0-2.3+deb8u1_amd64.deb
 27b9c812ba7f5cc2bb9b86e9b9cd167fff5530ea 623590 quassel-data-kde4_0.10.0-2.3+deb8u1_all.deb
Checksums-Sha256:
 49e1cf9fbc0c6a14d8dee6a48e7a7ac829525a8203e7f804dd0d0122c5908f71 2386 quassel_0.10.0-2.3+deb8u1.dsc
 68228ce23aa3a992add3d00cb1e8b4863d8ca64bea99c881edf6d16ff9ec7c23 2873233 quassel_0.10.0.orig.tar.bz2
 0aceb0c8d53dc194f2894e1f877d2313dd1e968042400b3daa40e08a26a47e58 22704 quassel_0.10.0-2.3+deb8u1.debian.tar.xz
 abd46b32a429eaf1acf78a868907b9fd5e5c08e0b13b6d41ccd9192e12708af0 1646958 quassel-core_0.10.0-2.3+deb8u1_amd64.deb
 076a97dcbfdbe6a00e0d7e03d8ecc1c39ea2f485b4249390c0b4334bbdefffb3 2438518 quassel-client_0.10.0-2.3+deb8u1_amd64.deb
 a9269d84b221bacdf3fe2ab6e5e171116fffac5fe2db8c85bc6e6f9097f25d9a 2849324 quassel_0.10.0-2.3+deb8u1_amd64.deb
 94ea9dd74601523727dc6beb8b0668d077a384bfc4eee966578c7f214670d292 22954 quassel-data_0.10.0-2.3+deb8u1_all.deb
 f91ad19cd3e0bed86fa1ac1d234f27fea5d92bfd18778f32fb3759ece419b4f1 837076 quassel-client-kde4_0.10.0-2.3+deb8u1_amd64.deb
 c9554a453e9196953dbed008829bc1d9160e4593529e70d81a65be173b4e2bbd 1076750 quassel-kde4_0.10.0-2.3+deb8u1_amd64.deb
 a704b2a45580ae2de7994876ca131c396174e56cdb957461f76550be40a95e1b 623590 quassel-data-kde4_0.10.0-2.3+deb8u1_all.deb
Files:
 0385beb11574e9757a123d7d25fc3777 2386 net optional quassel_0.10.0-2.3+deb8u1.dsc
 382466a7790979c172b7d7edf10a2981 2873233 net optional quassel_0.10.0.orig.tar.bz2
 bc36915aecdb9415595a9e64f2bfbcde 22704 net optional quassel_0.10.0-2.3+deb8u1.debian.tar.xz
 87b581b01dc2fc46cb8eba3887b028c4 1646958 net optional quassel-core_0.10.0-2.3+deb8u1_amd64.deb
 a8f0ba96727e72aacb9f4da15268cc31 2438518 net optional quassel-client_0.10.0-2.3+deb8u1_amd64.deb
 e6eb929c8a82e1696dbc4ac808b46ece 2849324 net optional quassel_0.10.0-2.3+deb8u1_amd64.deb
 4c20c2ffc255d7384bb4894d2ad74536 22954 net optional quassel-data_0.10.0-2.3+deb8u1_all.deb
 f2e9c0c21f3a1f799e5c7a197f4041bd 837076 net optional quassel-client-kde4_0.10.0-2.3+deb8u1_amd64.deb
 f48a4fa79b58ab55eccec662e69cd9de 1076750 net optional quassel-kde4_0.10.0-2.3+deb8u1_amd64.deb
 e1c54b6b449111cf88ca80958f3f585c 623590 net optional quassel-data-kde4_0.10.0-2.3+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJVT3cfAAoJEP4ixv2DE11FQiMQAIKXdj0QgiJx2fVXbhmNY2Zj
iroZ2hG40u+8D9Lt5YQamtaBgzcJf4jSVAwVTzvxQxtqma/peMBPj6LjKHi6/Zpb
Q1lO2N6o/otJxia2hqG3aAu5o05772dkiIXyeowEdYh7o2Y1QjdJHjQZ9i2kuVdb
qxRiPP438Nw6ztTlPCsYTCfneBuIRPOyA8Eiz42FdNpTYU7R4aTfuSonOYa/RODA
vucsG1qfXtbEU821hgWuCJQuaqqhUQ0cHEb/1Bq/skMHd5L3rkW+3qNIx+/BVOc2
zv8eXDBKN589SNI7vqgLcjyjKeQ8mcH4yAjFLpfAqK6nZHPQuTUdsgSRMPpkJTsg
fgJplUOmV/+XMhsTr1JA4buFFBgzoyUrUiPJ5NvsUzBRDGRZmhWC7yeYOxfHW+I2
DpRVvCITTp+fMZkZp1V+urvBILbcKt02mdXitArQZLAZU0K819QDlS2TkWyGuW82
DdRtNvHY/4ubDVJozThrNYwZRzcJm39cK7VDUK7+mXKVhbsepy88XnYnPf2La4U1
BlVJiQFdgphyrnfl2uVC/7qxnQvgYuBMtk3Dt35Kt7TTJhYDBFo3PPrxg7qyA1D2
2rCivMmbCM04d5hcWXBCW/DKjpYrqFoEIZEThRSWAuGE2UkDaFfaXIfetocurn1Y
3UNynaWMm9p0OIPdlCHh
=SwFw
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.