radicale: Upstream version 1.1 fixes several security issues (CVE-2015-8747 CVE-2015-8748)

Related Vulnerabilities: CVE-2015-8747   CVE-2015-8748  

Debian Bug report logs - #809920
radicale: Upstream version 1.1 fixes several security issues (CVE-2015-8747 CVE-2015-8748)

version graph

Package: radicale; Maintainer for radicale is Jonas Smedegaard <dr@jones.dk>; Source for radicale is src:radicale (PTS, buildd, popcon).

Reported by: Felix Knecht <debian@felixknecht.de>

Date: Mon, 4 Jan 2016 21:33:02 UTC

Severity: critical

Tags: fixed-upstream, security, upstream

Found in version radicale/1.0.1-2

Fixed in versions radicale/1.1.1-1, radicale/0.9-1+deb8u1, radicale/0.7-1.1+deb7u1

Done: Markus Koschany <apo@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Jonas Smedegaard <dr@jones.dk>:
Bug#809920; Package radicale. (Mon, 04 Jan 2016 21:33:05 GMT) (full text, mbox, link).


Acknowledgement sent to Felix Knecht <debian@felixknecht.de>:
New Bug report received and forwarded. Copy sent to Jonas Smedegaard <dr@jones.dk>. (Mon, 04 Jan 2016 21:33:05 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Felix Knecht <debian@felixknecht.de>
To: submit@bugs.debian.org
Subject: Upstream version 1.1 fixes several security issues
Date: Mon, 4 Jan 2016 22:22:58 +0100
Package: radicale
Version: 1.0.1-2
Severity: critical

Upstream of radicale has released a version 1.1 of radicale fixing
several security issues.
See http://radicale.org/news/

"Many improvements in this release are related to security, you should
upgrade Radicale as soon as possible:"

    Improve the regex used for well-known URIs (by Unrud)
    Prevent regex injection in rights management (by Unrud)
    Prevent crafted HTTP request from calling arbitrary functions (by Unrud)
    Improve URI sanitation and conversion to filesystem path (by Unrud)
    Decouple the daemon from its parent environment (by Unrud)



Added indication that bug 809920 blocks 650601 Request was from Tobias Frost <tobi@debian.org> to control@bugs.debian.org. (Mon, 04 Jan 2016 23:10:04 GMT) (full text, mbox, link).


Removed indication that bug 809920 blocks 650601 Request was from Tobias Frost <tobi@debian.org> to control@bugs.debian.org. (Mon, 04 Jan 2016 23:33:16 GMT) (full text, mbox, link).


Added tag(s) security. Request was from Yves-Alexis Perez <corsac@debian.org> to control@bugs.debian.org. (Tue, 05 Jan 2016 12:03:06 GMT) (full text, mbox, link).


Added tag(s) upstream and fixed-upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 05 Jan 2016 17:09:17 GMT) (full text, mbox, link).


Changed Bug title to 'radicale: Upstream version 1.1 fixes several security issues (CVE-2015-8747 CVE-2015-8748)' from 'Upstream version 1.1 fixes several security issues' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 06 Jan 2016 09:15:04 GMT) (full text, mbox, link).


Reply sent to Jonas Smedegaard <dr@jones.dk>:
You have taken responsibility. (Tue, 12 Jan 2016 04:21:04 GMT) (full text, mbox, link).


Notification sent to Felix Knecht <debian@felixknecht.de>:
Bug acknowledged by developer. (Tue, 12 Jan 2016 04:21:07 GMT) (full text, mbox, link).


Message #20 received at 809920-close@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>
To: 809920-close@bugs.debian.org
Subject: Bug#809920: fixed in radicale 1.1.1-1
Date: Tue, 12 Jan 2016 04:19:19 +0000
Source: radicale
Source-Version: 1.1.1-1

We believe that the bug you reported is fixed in the latest version of
radicale, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 809920@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jonas Smedegaard <dr@jones.dk> (supplier of updated radicale package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 12 Jan 2016 09:17:35 +0530
Source: radicale
Binary: radicale python-radicale python3-radicale
Architecture: source all
Version: 1.1.1-1
Distribution: unstable
Urgency: medium
Maintainer: Jonas Smedegaard <dr@jones.dk>
Changed-By: Jonas Smedegaard <dr@jones.dk>
Description:
 python-radicale - simple calendar and addressbook server - python2 module
 python3-radicale - simple calendar and addressbook server - python3 module
 radicale   - simple calendar and addressbook server - daemon
Closes: 809920
Changes:
 radicale (1.1.1-1) unstable; urgency=medium
 .
   [ upstream ]
   * New release(s).
     Changed functionality:
     + Use the first matching section for rights.
     Security fixes:
     + Improve the regex used for well-known URIs.
     + Prevent regex injection in rights management.
     + Prevent crafted HTTP request from calling arbitrary functions.
     + Improve URI sanitation and conversion to filesystem path.
     + Decouple the daemon from its parent environment.
     Closes: bug#809920 (CVE-2015-8747 CVE-2015-8748). Thanks to Felix
     Knecht.
     Bugfixes and minor enhancements:
     + Assign new items to correct key.
     + Avoid race condition in PID file creation.
     + Improve the docker version.
     + Encode message and committer for git commits.
     + Test with Python 3.5.
 .
   [ Jonas Smedegaard ]
   * Update TODOs.
   * Add NEWS entry about changed access rights parsing logic.
   * Drop patches now included upstream.
Checksums-Sha1:
 fb0e4f2f2b7f655c6563c122fa56da7c2b8f6286 2132 radicale_1.1.1-1.dsc
 cff3e6df3e55ac4534a826cb246a92591b1be1ec 52208 radicale_1.1.1.orig.tar.gz
 58ff3df1eedd5a654325e453c640bc4bd9b8dfc5 20444 radicale_1.1.1-1.debian.tar.xz
 8db29698c79e71f119ac0bcf8c20bab9fff8c60e 36822 python-radicale_1.1.1-1_all.deb
 5b0821e8f13d808c85eea8681f49b825d495de2b 36636 python3-radicale_1.1.1-1_all.deb
 d50beb6e0d947c8b75490cedac236e1811b2556a 28086 radicale_1.1.1-1_all.deb
Checksums-Sha256:
 6e0a9971a68aeeba49fe9b614e39f500d5c9648d6a8ff47b7b8c9a92d87f53fa 2132 radicale_1.1.1-1.dsc
 f978e6bdfab329a8d2d643584f02c4d2788a44b360ed4c326dea9e2735df81f6 52208 radicale_1.1.1.orig.tar.gz
 ea06661a6a71047daf1500a5aea0c275a0f15929c8dee4bb59858144c2afb2f0 20444 radicale_1.1.1-1.debian.tar.xz
 7e30f8c5b4debac2e5d346dd352c8250bfaec02533ec15f4bf98ca0824dcefb4 36822 python-radicale_1.1.1-1_all.deb
 b9e0f029a49a5dd813d8e519ddc695c02c31d8d4068ded19961d51b96804b727 36636 python3-radicale_1.1.1-1_all.deb
 72d9343aa719420a2d2796d7c2310c49ef978b07afe340300a6a515525ff83d0 28086 radicale_1.1.1-1_all.deb
Files:
 9721bfa07a59418c0eb963d50261597d 2132 web optional radicale_1.1.1-1.dsc
 aeb388f24cd64e75dda2c03c6b7ede18 52208 web optional radicale_1.1.1.orig.tar.gz
 41dc5b20f0c7fb3227caeacb09f05c46 20444 web optional radicale_1.1.1-1.debian.tar.xz
 30223b247f5a47984434d91f22d5674f 36822 python optional python-radicale_1.1.1-1_all.deb
 362b70813a60a74c7dbe11f12aeedfc2 36636 python optional python3-radicale_1.1.1-1_all.deb
 c1293afb8966c8d9d5700f0ffbdff40a 28086 web optional radicale_1.1.1-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWlHr5AAoJECx8MUbBoAEhBlIP/RFc1KMpRF1+JCa4dKSTQzT+
RQ08MtLzljGAw1fzAM/8jibep1odx8uvhtXnKrNt2A3TNKnj2sLjo2Of+utTE0qQ
AIpQNfrtsEU8k4xKcueEsbJYokJVoQOj0LGsJMzzOdnSQBfZXu3PmiZPv5uh0C27
mc+ryz2v8TTL2HeZlk8D5mhU17WlVVpNxBRfvDN/X9JiETQXlUvLYHIep/TDLLYe
3bJoGPdj96D1LnFIYXOCQjy+ixJJtaWA3kUarb2ov8O39klJ/I1T9T2lj3nBobQZ
BBjZksGtwQVMGeBMTZiRl1aXHrQikwqmVW4PUnQtKDqtWMWZp+Co5f6whX2mxUJN
JMecT7qsHdfxYfvEYmUf7Xt9hWeCyBDRzSkmAMfkOwk7Ammn9mAHtiOAsUG6woJ+
h8dV0qp/l7uORB06m2yHPp/qCzzZcPNiXkSlqCf+vltCce+1dyPCeLVnvNBvRK8p
r1DwEtm7kWRi9Wd42mupRZOVM93hpivoljgD6pWjynC16MDAAbdGkU7c/cN/K6kz
a0NB3MupnK/nDte7ebGUja9jScO9GTzvh8PpA34Wbi2VsmGFz/xutS7yV8fhwpns
Isyf6TgihkAH8i0cXOB7rESjluWpGcdXjfUOu6r+xqS+ELLSaljZ4RWzCD8eODWW
1C5XjLGmsMweWlw+89XS
=ahBN
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org, Jonas Smedegaard <dr@jones.dk>:
Bug#809920; Package radicale. (Thu, 28 Jan 2016 17:03:20 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
Extra info received and forwarded to list. Copy sent to Jonas Smedegaard <dr@jones.dk>. (Thu, 28 Jan 2016 17:03:21 GMT) (full text, mbox, link).


Message #25 received at 809920@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: team@security.debian.org
Cc: 809920@bugs.debian.org
Subject: radicale: CVE-2015-8748 CVE-2015-8747
Date: Thu, 28 Jan 2016 17:58:49 +0100
[Message part 1 (text/plain, inline)]
Hi,

I have prepared security updates for radicale in Wheezy and Jessie. This
is Debian bug #809920 [1]. I have tested both patches and they were
reviewed by upstream. The debdiffs are attached to this e-mail.

Regards,

Markus


[1] https://bugs.debian.org/809920
[radicale_jessie.debdiff (text/plain, attachment)]
[radicale_wheezy.debdiff (text/plain, attachment)]
[signature.asc (application/pgp-signature, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Jonas Smedegaard <dr@jones.dk>:
Bug#809920; Package radicale. (Sat, 30 Jan 2016 14:12:04 GMT) (full text, mbox, link).


Acknowledgement sent to Yves-Alexis Perez <corsac@debian.org>:
Extra info received and forwarded to list. Copy sent to Jonas Smedegaard <dr@jones.dk>. (Sat, 30 Jan 2016 14:12:04 GMT) (full text, mbox, link).


Message #30 received at 809920@bugs.debian.org (full text, mbox, reply):

From: Yves-Alexis Perez <corsac@debian.org>
To: Markus Koschany <apo@debian.org>, team@security.debian.org
Cc: 809920@bugs.debian.org
Subject: Re: radicale: CVE-2015-8748 CVE-2015-8747
Date: Sat, 30 Jan 2016 15:08:47 +0100
[Message part 1 (text/plain, inline)]
On jeu., 2016-01-28 at 17:58 +0100, Markus Koschany wrote:
> I have prepared security updates for radicale in Wheezy and Jessie. This
> is Debian bug #809920 [1]. I have tested both patches and they were
> reviewed by upstream. The debdiffs are attached to this e-mail.

Thanks. Can you remove the “by the security team” from the changelog entries,
and upload them to security-master? Remember to build with -sa because those
are the first security updates so they need the orig uploaded with them.

Regards,
-- 
Yves-Alexis

[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Jonas Smedegaard <dr@jones.dk>:
Bug#809920; Package radicale. (Sat, 30 Jan 2016 15:51:04 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
Extra info received and forwarded to list. Copy sent to Jonas Smedegaard <dr@jones.dk>. (Sat, 30 Jan 2016 15:51:04 GMT) (full text, mbox, link).


Message #35 received at 809920@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: team@security.debian.org
Cc: 809920@bugs.debian.org
Subject: Re: radicale: CVE-2015-8748 CVE-2015-8747
Date: Sat, 30 Jan 2016 16:47:42 +0100
[Message part 1 (text/plain, inline)]
Am 30.01.2016 um 15:08 schrieb Yves-Alexis Perez:
> On jeu., 2016-01-28 at 17:58 +0100, Markus Koschany wrote:
>> I have prepared security updates for radicale in Wheezy and Jessie. This
>> is Debian bug #809920 [1]. I have tested both patches and they were
>> reviewed by upstream. The debdiffs are attached to this e-mail.
> 
> Thanks. Can you remove the “by the security team” from the changelog entries,
> and upload them to security-master? Remember to build with -sa because those
> are the first security updates so they need the orig uploaded with them.

I have removed "by the security team" and uploaded both packages to
security-master.

Cheers,

Markus


[signature.asc (application/pgp-signature, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#809920; Package radicale. (Sat, 30 Jan 2016 17:39:08 GMT) (full text, mbox, link).


Acknowledgement sent to Jonas Smedegaard <dr@jones.dk>:
Extra info received and forwarded to list. (Sat, 30 Jan 2016 17:39:08 GMT) (full text, mbox, link).


Message #40 received at 809920@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>
To: 809920@bugs.debian.org, Markus Koschany <apo@debian.org>, team@security.debian.org
Subject: Re: Bug#809920: radicale: CVE-2015-8748 CVE-2015-8747
Date: Sat, 30 Jan 2016 23:10:50 +0530
[Message part 1 (text/plain, inline)]
Quoting Markus Koschany (2016-01-30 21:17:42)
> Am 30.01.2016 um 15:08 schrieb Yves-Alexis Perez:
> > On jeu., 2016-01-28 at 17:58 +0100, Markus Koschany wrote:
> >> I have prepared security updates for radicale in Wheezy and Jessie. 
> >> This is Debian bug #809920 [1]. I have tested both patches and they 
> >> were reviewed by upstream. The debdiffs are attached to this 
> >> e-mail.
> > 
> > Thanks. Can you remove the “by the security team” from the changelog 
> > entries, and upload them to security-master? Remember to build with 
> > -sa because those are the first security updates so they need the 
> > orig uploaded with them.
> 
> I have removed "by the security team" and uploaded both packages to 
> security-master.

Thanks!!

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Jonas Smedegaard <dr@jones.dk>:
Bug#809920; Package radicale. (Sat, 30 Jan 2016 18:51:04 GMT) (full text, mbox, link).


Acknowledgement sent to Yves-Alexis Perez <corsac@debian.org>:
Extra info received and forwarded to list. Copy sent to Jonas Smedegaard <dr@jones.dk>. (Sat, 30 Jan 2016 18:51:04 GMT) (full text, mbox, link).


Message #45 received at 809920@bugs.debian.org (full text, mbox, reply):

From: Yves-Alexis Perez <corsac@debian.org>
To: Markus Koschany <apo@debian.org>, team@security.debian.org
Cc: 809920@bugs.debian.org
Subject: Re: radicale: CVE-2015-8748 CVE-2015-8747
Date: Sat, 30 Jan 2016 19:49:11 +0100
[Message part 1 (text/plain, inline)]
On sam., 2016-01-30 at 16:47 +0100, Markus Koschany wrote:
> Am 30.01.2016 um 15:08 schrieb Yves-Alexis Perez:
> > On jeu., 2016-01-28 at 17:58 +0100, Markus Koschany wrote:
> > > I have prepared security updates for radicale in Wheezy and Jessie. This
> > > is Debian bug #809920 [1]. I have tested both patches and they were
> > > reviewed by upstream. The debdiffs are attached to this e-mail.
> > 
> > Thanks. Can you remove the “by the security team” from the changelog
> > entries,
> > and upload them to security-master? Remember to build with -sa because
> > those
> > are the first security updates so they need the orig uploaded with them.
> 
> I have removed "by the security team" and uploaded both packages to
> security-master.
> 
Thanks, I've processed your upload and sent the DSA mail.

Regards,
-- 
Yves-Alexis

[signature.asc (application/pgp-signature, inline)]

Reply sent to Markus Koschany <apo@debian.org>:
You have taken responsibility. (Sun, 31 Jan 2016 18:03:19 GMT) (full text, mbox, link).


Notification sent to Felix Knecht <debian@felixknecht.de>:
Bug acknowledged by developer. (Sun, 31 Jan 2016 18:03:19 GMT) (full text, mbox, link).


Message #50 received at 809920-close@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 809920-close@bugs.debian.org
Subject: Bug#809920: fixed in radicale 0.9-1+deb8u1
Date: Sun, 31 Jan 2016 18:02:46 +0000
Source: radicale
Source-Version: 0.9-1+deb8u1

We believe that the bug you reported is fixed in the latest version of
radicale, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 809920@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <apo@debian.org> (supplier of updated radicale package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 30 Jan 2016 16:36:20 +0100
Source: radicale
Binary: radicale python-radicale
Architecture: source all
Version: 0.9-1+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Jonas Smedegaard <dr@jones.dk>
Changed-By: Markus Koschany <apo@debian.org>
Description:
 python-radicale - simple calendar server - module
 radicale   - simple calendar server - daemon
Closes: 809920
Changes:
 radicale (0.9-1+deb8u1) jessie-security; urgency=high
 .
   * Non-maintainer upload.
   * CVE-2015-8748 and CVE-2015-8747:
     Fix insecure path handling by sanitizing system paths and always
     making them absolute. Fix multifilesystem backend allowed access
     to arbitrary files on all platforms. (Closes: #809920)
Checksums-Sha1:
 85cf841fd364a8b68e11ea706b1e5dad5a1d6de8 2171 radicale_0.9-1+deb8u1.dsc
 ed82a88f818bd96a1be57cd8660bf3cf2636048b 47833 radicale_0.9.orig.tar.gz
 d827ea147a8dc4f4b5d6df20a19b41a27f9f4adb 23708 radicale_0.9-1+deb8u1.debian.tar.xz
 df478680441b3e45e698dc1b2474230048aa7c96 26692 radicale_0.9-1+deb8u1_all.deb
 c2d1bf71a17f47fdc097ae8fcb25547c1918d02b 33512 python-radicale_0.9-1+deb8u1_all.deb
Checksums-Sha256:
 2afeff23304025654b9d204ae223c76090061928601e3924ab992cb0278fec79 2171 radicale_0.9-1+deb8u1.dsc
 512ae0b0af552bfd921e004ef795d1b42f090188e7afa2fa96276512be5a1205 47833 radicale_0.9.orig.tar.gz
 2f0d120539163a8fe4e621c9d918ff4f33fcef19b0afe1026f10ddd6fabbafb2 23708 radicale_0.9-1+deb8u1.debian.tar.xz
 605a8ab6fc95ce5a05a8bb22898a29cbfa2dc0201a0bf28237f44a99e647daf1 26692 radicale_0.9-1+deb8u1_all.deb
 2932f3e202d757e98487d65cb717e62a6974b7f74ee2ef1cfd54a5ed7370b246 33512 python-radicale_0.9-1+deb8u1_all.deb
Files:
 850b0d520eaa24eab91682c9fc7694fe 2171 web optional radicale_0.9-1+deb8u1.dsc
 ed4043f3d5659d8f5e5954db3ffd177a 47833 web optional radicale_0.9.orig.tar.gz
 153fa68cfd04b3da16bba2ee24698377 23708 web optional radicale_0.9-1+deb8u1.debian.tar.xz
 ec95469f2a07be460ecb1e8ac5c66404 26692 web optional radicale_0.9-1+deb8u1_all.deb
 1c5f1169677edc1f7eb6d5b105651bc3 33512 python optional python-radicale_0.9-1+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQJ8BAEBCgBmBQJWrNlxXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBQ0YzRDA4OEVGMzJFREVGNkExQTgzNUZE
OUFEMTRCOTUxM0I1MUU0AAoJENmtFLlRO1HkfBEP/RDOItaJq30VssEDIPBlTSRe
gJQJh5GO4cpl2qqok7sGqUw8YjgzcjCdnOINh5ywN4+MlGI6E0YigF9lDKsOE4sO
8YIEMquhVnnvLWKM6dYGc60HZhTwHnzsqfxXDUmyji4YWhcdaPxqPAZSnbJZEyyF
9dN5n0BUeaWFCxFkOHFLHvgD4YSaRayqwdfOEz2ZYivSA9GIdho0xvDTOx0afWj4
VtTCQXzu7UlMPKotaZR6JQ2HDearS7gsCFgF9XlL6xE+wkPsWyUUnWxrtMB7Wktt
9fbxY48YK3fEmXansk3LvAcEwf0Cuq6HMWWX0UK5kYsWJAUqWl+mv1ACsQUbk8gN
dL7PvOzh4IToR5iyolmpoDpAbRw5WuAvjVNfZqs+zoyT9wt/qXou6WOHJVKJOjV2
/ucE/XHIMdXg35IQ8l8/8eAf7aQyIllOwEssD7UdfqOSp0mix2Vt7QX5X99VMpr8
q+BaoGBpbbDhWd05tDK7mvqtJA9eNfzdOp59CRbn2MltvJqZlAG3SrTt+nytnpgU
tN2WbTW8Kky/YF7d27GowsC2NubbziCB1DC4Vt3OAe5LY7Jjq7tNd2rcAXBk6W/k
B4A9snmbt7gRzJ7K7L7NaJksMPlPa1A1T7UdOrYlq7YUTJVblw4QpQUSSBsFWFEI
QDkqGrMkLUx/U8bWwSCI
=dQ/D
-----END PGP SIGNATURE-----




Reply sent to Markus Koschany <apo@debian.org>:
You have taken responsibility. (Sun, 31 Jan 2016 18:06:18 GMT) (full text, mbox, link).


Notification sent to Felix Knecht <debian@felixknecht.de>:
Bug acknowledged by developer. (Sun, 31 Jan 2016 18:06:18 GMT) (full text, mbox, link).


Message #55 received at 809920-close@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 809920-close@bugs.debian.org
Subject: Bug#809920: fixed in radicale 0.7-1.1+deb7u1
Date: Sun, 31 Jan 2016 18:04:15 +0000
Source: radicale
Source-Version: 0.7-1.1+deb7u1

We believe that the bug you reported is fixed in the latest version of
radicale, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 809920@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <apo@debian.org> (supplier of updated radicale package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 30 Jan 2016 16:27:53 +0100
Source: radicale
Binary: radicale python-radicale
Architecture: source all
Version: 0.7-1.1+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Jonas Smedegaard <dr@jones.dk>
Changed-By: Markus Koschany <apo@debian.org>
Description: 
 python-radicale - simple calendar server - module
 radicale   - simple calendar server - daemon
Closes: 809920
Changes: 
 radicale (0.7-1.1+deb7u1) wheezy-security; urgency=high
 .
   * Non-maintainer upload.
   * CVE-2015-8748 and CVE-2015-8747:
     Fix insecure path handling by sanitizing system paths and always
     making them absolute. Version 0.7 of Radicale is only partly affected by
     CVE-2015-8747 because the multifilesystem storage does not exist in
     this version. (Closes: #809920)
Checksums-Sha1: 
 df1d8edc220366225d01dee82ed5cb82653d457c 2133 radicale_0.7-1.1+deb7u1.dsc
 baefc7c61495b8639e67fcdf518f82aeae89e8e3 35922 radicale_0.7.orig.tar.gz
 04b7a56c0d3d36d019a2c2473b77058d2c6fc177 15160 radicale_0.7-1.1+deb7u1.debian.tar.gz
 920c42de71a5b651593945c231cc8be8b62d8671 13924 radicale_0.7-1.1+deb7u1_all.deb
 6f3d51dddf4fc12d0bbb9149f2bbeea264cc076a 29018 python-radicale_0.7-1.1+deb7u1_all.deb
Checksums-Sha256: 
 f80269a585820ea6b95a7bf3d0775ef0a6d4ccafe185808e059e746fad737e4b 2133 radicale_0.7-1.1+deb7u1.dsc
 3b4eddb9172209f4603ec88f497637650b324c4ad90747dcdd50e092bee02cb2 35922 radicale_0.7.orig.tar.gz
 721c0f2cac580ee0f3ae3ce0c1a7318c1237f53997ae3146aa96ee00dcb22914 15160 radicale_0.7-1.1+deb7u1.debian.tar.gz
 75294caf025902598a99b89478ef031d249140fd3c579e573e14eed81c3d3e15 13924 radicale_0.7-1.1+deb7u1_all.deb
 80f264e999f82e634a19f7925d26dd06c9ee74afbe88098cad4777d1502cc1db 29018 python-radicale_0.7-1.1+deb7u1_all.deb
Files: 
 255ab08ad291a7efc87d7c89044de51f 2133 web optional radicale_0.7-1.1+deb7u1.dsc
 199568665d919be267485ac2147baf18 35922 web optional radicale_0.7.orig.tar.gz
 a6312985af3b617c6c969bc531f061b0 15160 web optional radicale_0.7-1.1+deb7u1.debian.tar.gz
 5af89cd9079ab87af0e02a8305c1d2b0 13924 web optional radicale_0.7-1.1+deb7u1_all.deb
 d2c3a1eff7fcf062ed2af378a1dc14f4 29018 python optional python-radicale_0.7-1.1+deb7u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQJ8BAEBCgBmBQJWrNgnXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBQ0YzRDA4OEVGMzJFREVGNkExQTgzNUZE
OUFEMTRCOTUxM0I1MUU0AAoJENmtFLlRO1Hk4S4P/2Uzgek/aHBYlHEVxI+4nrha
MHW6fpgONLjUWwmUCBp5RV9pl7y0vxy+3dQayb7ywQQQ4k/3J2Fo04vdK9otIKUm
Pd8e8uo7ztd7DG5CD0Lra5li+8dKvbaWPcZxxHbz8LzMnsbBP5HpNRmZYuHz1OQr
1ET2Wt7apr6bps7eO6kPYgeaq9aHZddJhpNgrdzq2LyMZMmquje8t7NaguEdWsMl
tKNFKbp32q/c1x1eTSmgMHmqCV1XB3PaNWuQ0E2L9yZzlXXgSU+lATre1Zipycez
hZpDBeiCTwaeDH1NvgP3ArO3ELRVpeZOhbd5dlXSC562UZSi+QM2UUoZThtj131N
QF3l2KN9cEkTw3cPKN+vZzQVQ097envM0OGa+xMA5gK+eZlH04ZUHab5RRP7Dr2g
oUev0xhKewmYVvWapbNNqc6Gz+kFrh6hfU85YN782RqsZWZT1sH8VPbQRDVuPKwt
mUToX+hIjyozTfnZIQaffqigo4KBTav3ee4NyGYSMen8MnPr3E07wX4u5Zm863J3
jCiWvTfhpzJCOnzrkwYb/q+FmHKeiOCeXOLbMpvisdGCVFUEduTjHZEUddePJ+40
XTxtcGtMane2R75AnKU2qY5bzqL6siCJ6DG73PUwaVnzVkTYae1H0pPDDbzXSLr4
2YGBJct4D368v2jSgo78
=Xj/Y
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 29 Feb 2016 07:26:10 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 18:05:57 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.