Debian Bug report logs -
#985085
salt: CVE-2021-25315
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, hostmasters@hostsharing.net, team@security.debian.org, team@security.debian.org, Debian Salt Team <pkg-salt-team@alioth-lists.debian.net>:
Bug#985085; Package src:salt.
(Fri, 12 Mar 2021 18:51:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Elimar Riesebieter <riesebie@lxtec.de>:
New Bug report received and forwarded. Copy sent to hostmasters@hostsharing.net, team@security.debian.org, team@security.debian.org, Debian Salt Team <pkg-salt-team@alioth-lists.debian.net>.
Your message had a Version: pseudo-header with an invalid package
version:
2016.11.2+ds-1+deb9u6 2018.3.4+dfsg1-6+deb10u2 3002.5+dfsg1-1
please either use found or fixed to the control server with a correct
version, or reply to this report indicating the correct version so the
maintainer (or someone else) can correct it for you.
(Fri, 12 Mar 2021 18:51:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: salt
Version: 2016.11.2+ds-1+deb9u6 2018.3.4+dfsg1-6+deb10u2 3002.5+dfsg1-1
Severity: normal
Tags: patch security upstream
X-Debbugs-Cc: hostmasters@hostsharing.net, Debian Security Team <team@security.debian.org>, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for salt.
CVE-2021-25315:
A Incorrect Implementation of Authentication Algorithm vulnerability
Maybe the following patch solves that issue:
https://bugzilla.suse.com/show_bug.cgi?id=1182382
It would be nice to have a backport to buster as well fixes
according to
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983632 doe buster
and stretch as well.
Thanks in advance
--
Elimar
Severity set to 'grave' from 'normal'
Request was from Elimar Riesebieter <riesebie@lxtec.de>
to control@bugs.debian.org.
(Fri, 12 Mar 2021 19:03:03 GMT) (full text, mbox, link).
Marked as found in versions salt/3002.5+dfsg1-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Fri, 12 Mar 2021 20:09:04 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Sat Mar 13 09:55:55 2021;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon