Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

CVE-2020-12135 in embedded bson

Related Vulnerabilities: CVE-2020-12135  

Source

Debian Bug report logs - #958998
CVE-2020-12135 in embedded bson

Package: src:duo-unix; Maintainer for src:duo-unix is Kees Cook <kees@debian.org>;

Reported by: Moritz Muehlenhoff <jmm@debian.org>

Date: Mon, 27 Apr 2020 21:12:01 UTC

Severity: normal

Tags: security, upstream

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, Kees Cook <kees@debian.org>:
Bug#958998; Package src:duo-unix. (Mon, 27 Apr 2020 21:12:03 GMT) (full text, mbox, link).

Acknowledgement sent to Moritz Muehlenhoff <jmm@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Kees Cook <kees@debian.org>. (Mon, 27 Apr 2020 21:12:03 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2020-12135 in embedded bson
Date: Mon, 27 Apr 2020 23:08:56 +0200
Source: duo-unix
Severity: normal
Tags: security

duo-unix seems to embed a copy of bson, which is affected by
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12135

Nothing inside duo-unix seems to call bson_ensure_space(), but
it probably still makes sense for upstream to update the embedded
copy to the latest version.

Cheers,
        Moritz

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 28 Apr 2020 04:12:02 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Tue Apr 28 08:37:05 2020; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started