node-cli: CVE-2016-10538

Debian Bug report logs - #809252
node-cli: CVE-2016-10538

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steve Kemp <steve@steve.org.uk>

To: submit@bugs.debian.org

Subject: node-cli: insecure use of temporary files

Date: Mon, 28 Dec 2015 18:28:58 +0000

Package: node-cli
Version: 0.4.4~20120516-1
Severity: critical
Tags: security

Dear Maintainer,

The `node-cli` library makes insecure use of the following two
temporary files:

        lock_file = '/tmp/' + cli.app + '.pid',
        log_file = '/tmp/' + cli.app + '.log';

These allow overwriting files  that the starting-user has permission
to modify.



-- System Information:
Debian Release: 8.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Message #10 received at 809252@bugs.debian.org (full text, mbox, reply):

From: Jens Krefeldt <j.krefeldt@gmail.com>

To: 809252@bugs.debian.org

Subject: Bug solved since v1.0.0

Date: Sun, 6 Nov 2016 21:38:46 +0100

[Message part 1 (text/plain, inline)]

Hi,

pls note that this bug is solved since v1.0.0, see https://github.com/node-js-libs/cli/issues/81 <https://github.com/node-js-libs/cli/issues/81> . Pls could you update this? It is still marked at https://nodesecurity.io/advisories/cli_arbitrary-file-write <https://nodesecurity.io/advisories/cli_arbitrary-file-write> and blames all modules referencing it even in version 1.0.0, e.g https://david-dm.org/deadratfink/jy-transform/development <https://david-dm.org/deadratfink/jy-transform/development>.

Thx and best,
Jens

[Message part 2 (text/html, inline)]

Message #21 received at 809252-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 809252-done@bugs.debian.org,

Cc: node-cli@packages.debian.org

Subject: Bug#921956: Removed package(s) from unstable

Date: Sun, 10 Feb 2019 22:07:52 +0000

Version: 0.4.4~20120516-1+rm

Dear submitter,

as the package node-cli has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/921956

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.