bro: CVE-2018-17019: Fix IRC names command parsing

Debian Bug report logs - #908779
bro: CVE-2018-17019: Fix IRC names command parsing

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Thu, 13 Sep 2018 22:39:17 +0200

Source: bro
Version: 2.5-1
Severity: important
Tags: patch security upstream
Control: found -1 2.5.5-1

Hi,

The following vulnerability was published for bro.

CVE-2018-17019[0]:
| In Bro through 2.5.5, there is a DoS in IRC protocol names command
| parsing in analyzer/protocol/irc/IRC.cc.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-17019
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17019
[1] https://github.com/bro/bro/commit/c2b18849f8bb833253538f5dfedb4ed1dc176a30

Regards,
Salvatore

Message #12 received at 908779@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 908779@bugs.debian.org

Subject: Re: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Tue, 29 Jan 2019 01:06:14 +0100

On Thu, Sep 13, 2018 at 10:39:17PM +0200, Salvatore Bonaccorso wrote:
> Source: bro
> Version: 2.5-1
> Severity: important
> Tags: patch security upstream
> Control: found -1 2.5.5-1
> 
> Hi,
> 
> The following vulnerability was published for bro.
> 
> CVE-2018-17019[0]:
> | In Bro through 2.5.5, there is a DoS in IRC protocol names command
> | parsing in analyzer/protocol/irc/IRC.cc.

ping, can we get this one (and CVE-2018-16807) uploaded still in time
for buster?

Cheers,
        Moritz

Message #17 received at 908779@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: 908779@bugs.debian.org

Subject: Re: Bug#908779: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Tue, 29 Jan 2019 02:19:20 +0100

* Moritz Mühlenhoff:

>> CVE-2018-17019[0]:
>> | In Bro through 2.5.5, there is a DoS in IRC protocol names command
>> | parsing in analyzer/protocol/irc/IRC.cc.
>
> ping, can we get this one (and CVE-2018-16807) uploaded still in time
> for buster?

Working on 2.6.1, but I need to get broker (and a new upstream versio
nof actor-framework) into unstable first. Working on that, too.

Cheers,
-Hilko

Message #22 received at 908779@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: 908779@bugs.debian.org

Subject: Re: Bug#908779: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Wed, 13 Feb 2019 00:23:33 +0100

* Hilko Bengen:

>>> | In Bro through 2.5.5, there is a DoS in IRC protocol names command
>>> | parsing in analyzer/protocol/irc/IRC.cc.
>>
>> ping, can we get this one (and CVE-2018-16807) uploaded still in time
>> for buster?
>
> Working on 2.6.1, but I need to get broker (and a new upstream versio
> nof actor-framework) into unstable first. Working on that, too.

So that didn't work out -- bro/2.6.1 is still sitting in NEW, along with
some of its build-dependencies. :-(

I don't know yet if or when I'll be able to backport fixes for the
outstanding CVE-worthy bugs.

Cheers,
-Hilko

Message #27 received at 908779@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Hilko Bengen <bengen@debian.org>

Cc: Moritz Mühlenhoff <jmm@inutil.org>, 908779@bugs.debian.org

Subject: Re: Bug#908779: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Thu, 14 Mar 2019 23:22:14 +0100

On Tue, Jan 29, 2019 at 02:19:20AM +0100, Hilko Bengen wrote:
> * Moritz Mühlenhoff:
> 
> >> CVE-2018-17019[0]:
> >> | In Bro through 2.5.5, there is a DoS in IRC protocol names command
> >> | parsing in analyzer/protocol/irc/IRC.cc.
> >
> > ping, can we get this one (and CVE-2018-16807) uploaded still in time
> > for buster?
> 
> Working on 2.6.1, but I need to get broker (and a new upstream versio
> nof actor-framework) into unstable first. Working on that, too.

With buster being in full freeze, can you backport CVE-2018-17019 and
CVE-2018-16807 to 2.5.5, please?

Cheers,
        Moritz

Message #32 received at 908779@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: 908779@bugs.debian.org

Subject: Re: Bug#908779: bro: CVE-2018-17019: Fix IRC names command parsing

Date: Thu, 21 Mar 2019 11:12:53 +0100

* Moritz Mühlenhoff:

>> Working on 2.6.1, but I need to get broker (and a new upstream versio
>> nof actor-framework) into unstable first. Working on that, too.

It's a pity that this did not work out...

> With buster being in full freeze, can you backport CVE-2018-17019 and
> CVE-2018-16807 to 2.5.5, please?

Yes, I'll try. Thanks for reminding me.

Cheers,
-Hilko

Send a report that this bug log contains spam.