openconnect: CVE-2020-12105

Debian Bug report logs - #959428
openconnect: CVE-2020-12105

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <bluca@debian.org>

To: submit@bugs.debian.org

Subject: openconnect: CVE-2020-12105

Date: Sat, 02 May 2020 11:29:34 +0100

[Message part 1 (text/plain, inline)]

Package: openconnect
Version: 6.00-2

Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
Not sure what's the oldest version affected, asked on 
https://security-tracker.debian.org/tracker/CVE-2020-12105

-- 
Kind regards,
Luca Boccassi

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 959428@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <bluca@debian.org>

To: 959428@bugs.debian.org

Cc: security@debian.org

Subject: Re: openconnect: CVE-2020-12105

Date: Sat, 02 May 2020 13:41:53 +0100

[Message part 1 (text/plain, inline)]

Control: notfound -1 6.00-2
Control: close -1

On Sat, 02 May 2020 11:29:34 +0100 Luca Boccassi <bluca@debian.org>
wrote:
> Package: openconnect
> Version: 6.00-2
> 
> Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
> Not sure what's the oldest version affected, asked on 
> https://security-tracker.debian.org/tracker/CVE-2020-12105

I checked and upstream confirmed, Debian is not vulnerable in any
version as the defect only affects builds with OpenSSL, but we use
GNUTLS all the way back to old-old-stable.

https://gitlab.com/openconnect/openconnect/-/merge_requests/96

Dear Security Team,

At your earliest convenience, please mark 
https://security-tracker.debian.org/tracker/CVE-2020-12105 as not-
affected for all Debian releases.

Thanks!

-- 
Kind regards,
Luca Boccassi

[signature.asc (application/pgp-signature, inline)]

Message #21 received at 959428@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Luca Boccassi <bluca@debian.org>

Cc: 959428@bugs.debian.org, security@debian.org

Subject: Re: openconnect: CVE-2020-12105

Date: Sat, 2 May 2020 14:51:04 +0200

Hi Luca,

On Sat, May 02, 2020 at 01:41:53PM +0100, Luca Boccassi wrote:
> Control: notfound -1 6.00-2
> Control: close -1
> 
> On Sat, 02 May 2020 11:29:34 +0100 Luca Boccassi <bluca@debian.org>
> wrote:
> > Package: openconnect
> > Version: 6.00-2
> > 
> > Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
> > Not sure what's the oldest version affected, asked on 
> > https://security-tracker.debian.org/tracker/CVE-2020-12105
> 
> I checked and upstream confirmed, Debian is not vulnerable in any
> version as the defect only affects builds with OpenSSL, but we use
> GNUTLS all the way back to old-old-stable.
> 
> https://gitlab.com/openconnect/openconnect/-/merge_requests/96
> 
> Dear Security Team,
> 
> At your earliest convenience, please mark 
> https://security-tracker.debian.org/tracker/CVE-2020-12105 as not-
> affected for all Debian releases.

Thanks!

I have marked it now as unimportant (the source affected, but does not
affect the binary packages as we use GnuTLS). Will take up to an hour
until the CVE entry is updated on security-tracker.

Regards,
Salvatore

Message #26 received at submit@bugs.debian.org (full text, mbox, reply):

From: David Woodhouse <dwmw2@infradead.org>

To: Luca Boccassi <bluca@debian.org>,959428@bugs.debian.org,submit@bugs.debian.org

Subject: Re: Bug#959428: openconnect: CVE-2020-12105

Date: Sat, 02 May 2020 13:17:49 +0100

[Message part 1 (text/plain, inline)]

Which means since 7.07 in July 2016.

On 2 May 2020 11:29:34 BST, Luca Boccassi <bluca@debian.org> wrote:
>Package: openconnect
>Version: 6.00-2
>
>Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
>Not sure what's the oldest version affected, asked on 
>https://security-tracker.debian.org/tracker/CVE-2020-12105
>
>-- 
>Kind regards,
>Luca Boccassi

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Message part 2 (text/html, inline)]

Message #31 received at submit@bugs.debian.org (full text, mbox, reply):

From: David Woodhouse <dwmw2@infradead.org>

To: Luca Boccassi <bluca@debian.org>,959428@bugs.debian.org,submit@bugs.debian.org

Subject: Re: Bug#959428: openconnect: CVE-2020-12105

Date: Sat, 02 May 2020 13:14:34 +0100

[Message part 1 (text/plain, inline)]

Since that code (for OpenSSL 1.0.2+) was first added in https://gitlab.com/openconnect/openconnect/-/commit/674881cbb078937d84c9b16219b52d7b56623ba7

On 2 May 2020 11:29:34 BST, Luca Boccassi <bluca@debian.org> wrote:
>Package: openconnect
>Version: 6.00-2
>
>Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
>Not sure what's the oldest version affected, asked on 
>https://security-tracker.debian.org/tracker/CVE-2020-12105
>
>-- 
>Kind regards,
>Luca Boccassi

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Message part 2 (text/html, inline)]

Message #46 received at 959428@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <bluca@debian.org>

To: David Woodhouse <dwmw2@infradead.org>, 959428@bugs.debian.org

Subject: Re: Bug#959428: openconnect: CVE-2020-12105

Date: Sat, 02 May 2020 14:10:13 +0100

[Message part 1 (text/plain, inline)]

Control: -1 found 7.07-1
Control: -1 fixed 8.09-1

On Sat, 2020-05-02 at 13:17 +0100, David Woodhouse wrote:
> Which means since 7.07 in July 2016.
> 
> On 2 May 2020 11:29:34 BST, Luca Boccassi <bluca@debian.org> wrote:
> > Package: openconnect
> > Version: 6.00-2
> > 
> > Tracking https://security-tracker.debian.org/tracker/CVE-2020-12105
> > Not sure what's the oldest version affected, asked on 
> > https://security-tracker.debian.org/tracker/CVE-2020-12105

Yep - we never built with libssl so we are ok in Debian/Ubuntu. I'll
record the versions as the sources are vulnerable, just in the off-
chance some downstream uses libssl for whatever reason.

-- 
Kind regards,
Luca Boccassi

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.