libapache2-mod-nss: CVE-2015-3277: incorrect multi-keyword mode cipherstring parsing

Debian Bug report logs - #795657
libapache2-mod-nss: CVE-2015-3277: incorrect multi-keyword mode cipherstring parsing

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libapache2-mod-nss: CVE-2015-3277: incorrect multi-keyword mode cipherstring parsing

Date: Sun, 16 Aug 2015 08:05:18 +0200

Source: libapache2-mod-nss
Version: 1.0.11-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for libapache2-mod-nss,
introduced with the update to 1.0.11.

CVE-2015-3277[0]:
incorrect multi-keyword mode cipherstring parsing

The vulnerable code was added in 1.0.11[1] afaict.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-3277
[1] https://git.fedorahosted.org/cgit/mod_nss.git/commit/?id=2d1650900f4d47dc43400d826c0f7e1a7c5229b8
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1238324

Could you please double-check this?

Regards,
Salvatore

Message #10 received at 795657@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 795657@bugs.debian.org

Subject: Re: libapache2-mod-nss: CVE-2015-3277: incorrect multi-keyword mode cipherstring parsing

Date: Sun, 4 Jun 2017 08:26:19 +0200

On Sun, Aug 16, 2015 at 08:05:18AM +0200, Salvatore Bonaccorso wrote:
> Source: libapache2-mod-nss
> Version: 1.0.11-1
> Severity: important
> Tags: security upstream
> 
> Hi,
> 
> the following vulnerability was published for libapache2-mod-nss,
> introduced with the update to 1.0.11.
> 
> CVE-2015-3277[0]:
> incorrect multi-keyword mode cipherstring parsing
> 
> The vulnerable code was added in 1.0.11[1] afaict.

What's the status, this bug is 2.5 years old. Is this fixed in 1.0.14?

Cheers,
        Moritz


> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2015-3277
> [1] https://git.fedorahosted.org/cgit/mod_nss.git/commit/?id=2d1650900f4d47dc43400d826c0f7e1a7c5229b8
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=1238324
> 
> Could you please double-check this?
> 
> Regards,
> Salvatore
> 

Message #15 received at 795657@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 795657@bugs.debian.org

Subject: Re: Bug#795657: libapache2-mod-nss: CVE-2015-3277: incorrect multi-keyword mode cipherstring parsing

Date: Sun, 4 Jun 2017 09:02:15 +0200

Hi,

On Sun, Jun 04, 2017 at 08:26:19AM +0200, Moritz Mühlenhoff wrote:
> On Sun, Aug 16, 2015 at 08:05:18AM +0200, Salvatore Bonaccorso wrote:
> > Source: libapache2-mod-nss
> > Version: 1.0.11-1
> > Severity: important
> > Tags: security upstream
> > 
> > Hi,
> > 
> > the following vulnerability was published for libapache2-mod-nss,
> > introduced with the update to 1.0.11.
> > 
> > CVE-2015-3277[0]:
> > incorrect multi-keyword mode cipherstring parsing
> > 
> > The vulnerable code was added in 1.0.11[1] afaict.
> 
> What's the status, this bug is 2.5 years old. Is this fixed in 1.0.14?

AFAICT, in ChangeLog up to 1.0.14 this seems still unresolved. The Red
Hat bug seem to indicate that as well (note I adjusted the introducing
commit reference in the security-tracker since the upstream git repo
moved to pagure.io apparently).

Salvatore

Message #20 received at 795657-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 795657-done@bugs.debian.org,899567-done@bugs.debian.org,

Cc: libapache2-mod-nss@packages.debian.org

Subject: Bug#915512: Removed package(s) from unstable

Date: Thu, 07 Feb 2019 03:20:54 +0000

Version: 1.0.14-1+rm

Dear submitter,

as the package libapache2-mod-nss has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/915512

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.