openjpeg2: CVE-2020-27843

Debian Bug report logs - #983663
openjpeg2: CVE-2020-27843

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: openjpeg2: CVE-2020-27843

Date: Sun, 28 Feb 2021 10:34:49 +0100

Source: openjpeg2
Version: 2.4.0-3
Severity: important
Tags: security upstream
Forwarded: https://github.com/uclouvain/openjpeg/issues/1297
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.3.0-2+deb10u1
Control: found -1 2.3.0-2

Hi,

The following vulnerability was published for openjpeg2.

CVE-2020-27843[0]:
| A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw
| allows an attacker to provide specially crafted input to the
| conversion or encoding functionality, causing an out-of-bounds read.
| The highest threat from this vulnerability is system availability.

The issue is prevented in 2.4.0 but as per upstream the commited
change is unlikely to be the proper fix. Thus still keeping the 2.4.0
as affected.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-27843
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27843
[1] https://github.com/uclouvain/openjpeg/issues/1297

Regards,
Salvatore

Message #12 received at 983663-submitter@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 983663-submitter@bugs.debian.org

Subject: Re: Bug#983663: openjpeg2: CVE-2020-27843

Date: Mon, 1 Mar 2021 08:16:17 +0100

Control: fixed -1 2.4.0-3

On Sun, Feb 28, 2021 at 10:39 AM Salvatore Bonaccorso <carnil@debian.org> wrote:
[...]
> The issue is prevented in 2.4.0 but as per upstream the commited
> change is unlikely to be the proper fix. Thus still keeping the 2.4.0
> as affected.
[...]

Here is the correct quote from upstream:

> The security issue is solved by the fix that was committed, but I believe there's a more fundamental functional issue that, in an ideal world, would deserve to be solved

Keeping the same bug number for two different issues defeat the whole
purpose of proper bug reporting.

Message #25 received at 983663-quiet@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Mathieu Malaterre <malat@debian.org>, 983663-quiet@bugs.debian.org

Subject: Re: Bug#983663: openjpeg2: CVE-2020-27843

Date: Mon, 1 Mar 2021 08:24:54 +0100

Hi,

On Mon, Mar 01, 2021 at 08:16:17AM +0100, Mathieu Malaterre wrote:
> Control: fixed -1 2.4.0-3
> 
> On Sun, Feb 28, 2021 at 10:39 AM Salvatore Bonaccorso <carnil@debian.org> wrote:
> [...]
> > The issue is prevented in 2.4.0 but as per upstream the commited
> > change is unlikely to be the proper fix. Thus still keeping the 2.4.0
> > as affected.
> [...]
> 
> Here is the correct quote from upstream:
> 
> > The security issue is solved by the fix that was committed, but I believe there's a more fundamental functional issue that, in an ideal world, would deserve to be solved
> 
> Keeping the same bug number for two different issues defeat the whole
> purpose of proper bug reporting.

Yes I do agree. As you might have noticed after filling the Debian bug
I tried to clarify this with upstream, and got later on the above
quoted reply. I  did just not yet follwed up in Debian.

Regards,
Salvatore

Message #28 received at 983663-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 983663-submitter@bugs.debian.org

Subject: closing 983663, notfound 983663 in .2.4.0-3

Date: Mon, 01 Mar 2021 08:26:14 +0100

close 983663 2.4.0-1
notfound 983663 .2.4.0-3
thanks

Send a report that this bug log contains spam.