isync: CVE-2021-3578

Debian Bug report logs - #989564
isync: CVE-2021-3578

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: isync: CVE-2021-3578

Date: Mon, 07 Jun 2021 18:05:26 +0200

Source: isync
Version: 1.3.0-2.1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.3.0-2

Hi,

The following vulnerability was published for isync.

CVE-2021-3578[0]:
| possible remote code execution in isync/mbsync

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-3578
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3578
[1] https://www.openwall.com/lists/oss-security/2021/06/07/1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 989564-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 989564-close@bugs.debian.org

Subject: Bug#989564: fixed in isync 1.3.0-2.2

Date: Mon, 07 Jun 2021 19:33:37 +0000

Source: isync
Source-Version: 1.3.0-2.2
Done: Salvatore Bonaccorso <carnil@debian.org>

We believe that the bug you reported is fixed in the latest version of
isync, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 989564@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated isync package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 07 Jun 2021 21:03:56 +0200
Source: isync
Architecture: source
Version: 1.3.0-2.2
Distribution: unstable
Urgency: medium
Maintainer: Nicolas Boullis <nboullis@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 989564
Changes:
 isync (1.3.0-2.2) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * fix handling of unexpected APPENDUID response code (CVE-2021-3578)
     (Closes: #989564)
Checksums-Sha1: 
 bce2b7f7266ffb23f2df2a621daf854f51fde048 2049 isync_1.3.0-2.2.dsc
 7125e31bf192ce06d6b3bcf013c3810c41f376dc 9828 isync_1.3.0-2.2.debian.tar.xz
Checksums-Sha256: 
 45bdbf4ef2dfe64f85c56ebca99cddd309cfff99a5f61a35e0d27470d511d673 2049 isync_1.3.0-2.2.dsc
 6ec3160514deabcdaccef79c7ea8e1f07abf5d250542ba02e3891a62edd3b89c 9828 isync_1.3.0-2.2.debian.tar.xz
Files: 
 dc1098eea9d48957c47bff85ae1e29e1 2049 mail optional isync_1.3.0-2.2.dsc
 3f23f58e389233320792771215959c87 9828 mail optional isync_1.3.0-2.2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmC+bz5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EhkcP/Rd7CvG23kN8wGwMNsYQIR3ntUjm3wZI
pE/15bTZ9fFMO1xSwoaz03sppr7gmrH6LUKjmug4ZwGEVQP/5Ocn3/sK3elAOoP/
DEpLTrnVn70t4g5fqnxjkm3H4PiMHbCu+X8Tv6ble9uBnYgM4KP4mHiOMIj3R+is
Qo105PUfTIT61himYe27K7CULtWInxhs+cyiCADQc43UD6MxaC1BSDjbMPi6J2md
scf7H7MYe6eeBcNhcC81dpA436az1OuvG+/6/KHxn8R9q6PsRpkMudKacq4Le4yu
ZMBqe6qk2+RUivNouTEuSwyVXGYN3F7KnbxMi0BJTZLkKgsLkc3DXH2wum09m7jo
Y7oTdEPFBv9id2XQ68qT1ipjrAXrsmmu54SJoWYLkLnBffmIMrHZPozzklm2vca3
9YIUi/fVYesx19m6u445PPnFVRQccdO2SFOm3IqnimAZItBJKIHbW8Wlr4BH1F/C
gVZDanZ/dijbM3IBh4aD+oUMmyDSasziDSegtXKYd41L4Otrl86g3VvSl67wFfLQ
MXIn932J72bFcUDrNqomkXT/RFBdzCudV+cpC+PYhDvfmmYf0UrRuEEeLDBBRCta
EDj9FxUF/vPRcjVMmsarQ6O1ZgzJiFr4AO/DbEZbaPFFcm58roHlzKu+YZAj8Ifi
gQH+zdA4E6pM
=DQb8
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.