CVE-2010-2060

Debian Bug report logs - #585162
CVE-2010-2060

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2010-2060

Date: Wed, 09 Jun 2010 19:01:44 +0200

Package: beanstalkd
Severity: normal

Hi,
please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2060 
for a reported security issue in beanstalkd. However, since the
description states
 .
| Beanstalkd is meant to be ran in a trusted network, as it has no
| authorisation/authentication mechanisms.

this is likely a non-issue?

Cheers,
        Moritz

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Message #10 received at 585162@bugs.debian.org (full text, mbox, reply):

From: Serafeim Zanikolas <sez@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 585162@bugs.debian.org

Cc: Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: Bug#585162: CVE-2010-2060

Date: Wed, 9 Jun 2010 23:17:37 +0200

fixed 585162 1.4.6-1
thanks

Thanks for the notice Moritz. I'm already aware of the issue, and I've
uploaded over a week ago the new upstream that fixes it.

On Wed, Jun 09, 2010 at 07:01:44PM +0200, Moritz Muehlenhoff wrote [edited]:
> please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2060

That page is wrong in stating that 1.4.6-1 is vulnerable.

> | Beanstalkd is meant to be ran in a trusted network, as it has no
> | authorisation/authentication mechanisms.
> 
> this is likely a non-issue?

Indeed, it's no big deal, but nevertheless should be fixed for squeeze. I did
the upload with urgency=medium, but it got stuck due to a random
(unreproducible) build error in a mips host. I'll give them yet another ping
to retry the build (not sure whether they missed my request, or they just have
a long backlog).

I'll close the bug as soon as 1.4.5 is gone from testing.

Cheers,
Serafeim

Message #17 received at 585162@bugs.debian.org (full text, mbox, reply):

From: Serafeim Zanikolas <sez@debian.org>

To: mips@buildd.debian.org

Cc: 585162@bugs.debian.org

Subject: Re: please retry a build of beanstalkd

Date: Wed, 9 Jun 2010 23:21:16 +0200

On Tue, Jun 01, 2010 at 11:14:23PM +0200, Serafeim Zanikolas wrote:
> Please retry a build of beanstalkd-1.4.6-1 for the mips arch.
> 
> Justification: beanstalkd FTBFS in ball.d.o (due to a test failure) but I
> repeatedly failed to reproduce the test failure in gabrielli.d.o (another mips
> host).

Any news on this? It's rather important to get this release to testing,
because it fixes a security issue.

Cheers,
Serafeim

Message #22 received at 585162@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Serafeim Zanikolas <sez@debian.org>

Cc: 585162@bugs.debian.org

Subject: Re: Bug#585162: CVE-2010-2060

Date: Wed, 9 Jun 2010 23:22:54 +0200

On Wed, Jun 09, 2010 at 11:17:37PM +0200, Serafeim Zanikolas wrote:
> fixed 585162 1.4.6-1
> thanks
> 
> Thanks for the notice Moritz. I'm already aware of the issue, and I've
> uploaded over a week ago the new upstream that fixes it.
> 
> On Wed, Jun 09, 2010 at 07:01:44PM +0200, Moritz Muehlenhoff wrote [edited]:
> > please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2060
> 
> That page is wrong in stating that 1.4.6-1 is vulnerable.

Thanks, noted in the Debian security tracker.
 
Cheers,
        Moritz

Message #27 received at 585162-done@bugs.debian.org (full text, mbox, reply):

From: Serafeim Zanikolas <sez@debian.org>

To: 585162-done@bugs.debian.org

Subject: clsoing as 1.4.5 is no longer in stable/testing

Date: Wed, 23 Mar 2011 09:56:29 +0100

Send a report that this bug log contains spam.