spice: CVE-2021-20201: Client initiated renegotiation denial of service

Debian Bug report logs - #983698
spice: CVE-2021-20201: Client initiated renegotiation denial of service

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: spice: CVE-2021-20201: Client initiated renegotiation denial of service

Date: Sun, 28 Feb 2021 16:17:19 +0100

Source: spice
Version: 0.14.3-2
Severity: important
Tags: security upstream
Forwarded: https://gitlab.freedesktop.org/spice/spice/-/issues/49
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 0.14.0-1.3+deb10u1
Control: found -1 0.14.0-1.3

Hi,

The following vulnerability was published for spice.

CVE-2021-20201[0]:
| Client initiated renegotiation denial of service

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-20201
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20201
[1] https://gitlab.freedesktop.org/spice/spice/-/issues/49

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #14 received at 983698@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 983698@bugs.debian.org

Subject: spice: diff for NMU version 0.14.3-2.1

Date: Sun, 28 Feb 2021 16:47:51 +0100

[Message part 1 (text/plain, inline)]

Control: tags 983698 + patch
Control: tags 983698 + pending

Dear maintainer,

I've prepared an NMU for spice (versioned as 0.14.3-2.1) and
uploaded it to DELAYED/10. Please feel free to tell me if I
should delay it longer.

Related merge request is
https://salsa.debian.org/qemu-team/spice/-/merge_requests/3 and the
sole reason I did is tho have more such issues fixed in bullseye if
possible. On the other side the issue would otherwise not be urgent
and is defintively more on the no-dsa range for a stable release.

Furthermore used both commits from upstream although only one would be
relevant.

Let me know if I should cancel it as well if you would not like to see
this change in this way as proposed.

Regards,
Salvatore

[spice-0.14.3-2.1-nmu.diff (text/x-diff, attachment)]

Send a report that this bug log contains spam.