CVE-2019-10044

Debian Bug report logs - #927711
CVE-2019-10044

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2019-10044

Date: Sun, 21 Apr 2019 22:18:12 +0200

Package: telegram-desktop
Severity: grave
Tags: security

This was assigned CVE-2019-10044 and is claimed to be fixed in 1.5.12:
https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt

Cheers,
        Moritz

Message #16 received at 927711@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 927711@bugs.debian.org

Subject: Re: CVE-2019-10044

Date: Thu, 9 May 2019 22:42:08 +0200

On Sun, Apr 21, 2019 at 10:18:12PM +0200, Moritz Muehlenhoff wrote:
> Package: telegram-desktop
> Severity: grave
> Tags: security
> 
> This was assigned CVE-2019-10044 and is claimed to be fixed in 1.5.12:
> https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt

What's the status? Has upstream been contacted for an isolated fix, are
you planning to address this for buster?

Cheers,
       Moritz
> 

Message #21 received at 927711@bugs.debian.org (full text, mbox, reply):

From: Коля Гурьев <guriev-ns@ya.ru>

To: Moritz Mühlenhoff <jmm@inutil.org>, 927711@bugs.debian.org

Subject: Re: Bug#927711: CVE-2019-10044

Date: Sat, 11 May 2019 17:38:50 +0300

Hi,

09.05.2019 23:42, Moritz Mühlenhoff пишет:
> What's the status? Has upstream been contacted for an isolated fix, are
> you planning to address this for buster?


As John Preston said, there was no a special fix of the issue in 1.5.12.
It is mistake that this version is considered to contain the fix.
And as far as I can see, Telegram Desktop has no a fix of this CVE yet.

At least some code[1] in HistoryWebPage checks for hidden URLs. But it
does not always work properly. For example, it shows a confirmation
for https://www.аррӏе.com/ (https://www.xn--80ak6aa92e.com/) but not
for http://blаzeinfosec.com (http://xn--blzeinfosec-zij.com).

 [1]: https://sources.debian.org/src/telegram-desktop/1.5.11-1/Telegram/SourceFiles/history/media/history_media_web_page.cpp/#L133

Message #26 received at 927711@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Коля Гурьев <guriev-ns@ya.ru>

Cc: 927711@bugs.debian.org

Subject: Re: Bug#927711: CVE-2019-10044

Date: Fri, 14 Jun 2019 16:29:11 +0200

On Sat, May 11, 2019 at 05:38:50PM +0300, Коля Гурьев wrote:
> As John Preston said, there was no a special fix of the issue in 1.5.12.
> It is mistake that this version is considered to contain the fix.
> And as far as I can see, Telegram Desktop has no a fix of this CVE yet.

Ack, ok.

Cheers,
        Moritz

Send a report that this bug log contains spam.