Debian Bug report logs -
#701052
isync: CVE-2013-0289: Incorrect server's SSL x509.v3 certificate validation when performing IMAP synchronization
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Wed, 20 Feb 2013 23:12:02 UTC
Severity: grave
Tags: patch, security
Found in version isync/1.0.4-2.1
Fixed in version isync/1.0.4-2.2
Done: Salvatore Bonaccorso <carnil@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Nicolas Boullis <nboullis@debian.org>
:
Bug#701052
; Package isync
.
(Wed, 20 Feb 2013 23:12:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Nicolas Boullis <nboullis@debian.org>
.
(Wed, 20 Feb 2013 23:12:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: isync
Version: 1.0.4-2.1
Severity: grave
Tags: security patch
Hi,
the following vulnerability was published for isync.
CVE-2013-0289[0]:
missing SSL subject verification
A patch is available in upstream's git repository[1].
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] http://security-tracker.debian.org/tracker/CVE-2013-0289
[1] http://isync.git.sourceforge.net/git/gitweb.cgi?p=isync/isync;a=patch;h=914ede18664980925628a9ed2a73ad05f85aeedb
Regards,
Salvatore
Information forwarded
to debian-bugs-dist@lists.debian.org, Nicolas Boullis <nboullis@debian.org>
:
Bug#701052
; Package isync
.
(Sun, 24 Feb 2013 08:45:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Extra info received and forwarded to list. Copy sent to Nicolas Boullis <nboullis@debian.org>
.
(Sun, 24 Feb 2013 08:45:03 GMT) (full text, mbox, link).
Message #10 received at 701052@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
tags 701052 + pending
thanks
Hi Nicolas, hi Theodore
I've prepared an NMU for isync (versioned as 1.0.4-2.2) and
uploaded it to DELAYED/7. Please feel free to tell me if I
should delay it longer.
Note I have choosen a slighly higher delay as proposed in
dev-ref, to 7 days as I have not notified in the BTS that I
would be interested in NMU. But the above holds: please let
me know if you want to do the upload yourself and I should
cancel the upload.
Regards,
Salvatore
[isync-1.0.4-2.2-nmu.diff (text/x-diff, attachment)]
Added tag(s) pending.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Sun, 24 Feb 2013 08:45:08 GMT) (full text, mbox, link).
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>
:
You have taken responsibility.
(Sun, 03 Mar 2013 09:18:14 GMT) (full text, mbox, link).
Notification sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Bug acknowledged by developer.
(Sun, 03 Mar 2013 09:18:14 GMT) (full text, mbox, link).
Message #17 received at 701052-close@bugs.debian.org (full text, mbox, reply):
Source: isync
Source-Version: 1.0.4-2.2
We believe that the bug you reported is fixed in the latest version of
isync, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 701052@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated isync package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 24 Feb 2013 09:27:55 +0100
Source: isync
Binary: isync
Architecture: source amd64
Version: 1.0.4-2.2
Distribution: unstable
Urgency: low
Maintainer: Nicolas Boullis <nboullis@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
isync - Synchronize a local maildir with a remote IMAP4 mailbox
Closes: 701052
Changes:
isync (1.0.4-2.2) unstable; urgency=low
.
* Non-maintainer upload.
* Apply upstream patch for CVE-2013-0289.
Fix incorrect server's SSL x509.v3 certificate validation when
performing IMAP synchronization. (Closes: #701052)
Checksums-Sha1:
5ace89a63a3181e964eb3331a1e8010c307cabe4 1722 isync_1.0.4-2.2.dsc
445ef05e4216a27bcee2c5d0abdbc676203cd1bb 8681 isync_1.0.4-2.2.diff.gz
22657b4a0c5566e41dfd2f6ee3076be616e46659 98046 isync_1.0.4-2.2_amd64.deb
Checksums-Sha256:
92d540de20711d34d6b2007343313a7f761ac84c3465629bb7af4f13b69ff584 1722 isync_1.0.4-2.2.dsc
8358501265b64381ebd58f7e819dd73c3c1b5fda93498d6a8a6f068429dd4161 8681 isync_1.0.4-2.2.diff.gz
17f54ebb3b986f258ef5b3975c8d73c90e5ce23fddafb287d67d63a222668b20 98046 isync_1.0.4-2.2_amd64.deb
Files:
5f88ae067f5a920c0bfca3e0f02f209d 1722 mail optional isync_1.0.4-2.2.dsc
03156fd95fab50a96359147ef20b00ab 8681 mail optional isync_1.0.4-2.2.diff.gz
7293c360af2b000e993121ab1f6f1a58 98046 mail optional isync_1.0.4-2.2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCgAGBQJRKc9nAAoJEHidbwV/2GP+CVAP/1t0BwtxYWjankU3AJ41ZLkz
OPZ6dpmPVMoCmv2tT/2XiDQEi9ljU6pd/EQgJk4/G42qLYe8sIqeYEvbkpoifvcg
aE9ozPicC9mBRpowHHoi5iirJSLzM/7tpsp0PtOSIlvjka3H/V/xn1LI9YlhKmp/
eyc6HjnsAXmu6pJtMex1iXuLDp/Zg5NBY2Sr+VpbHiBUSC03E0u9IgClRK0Qtng/
TOfM2kUr2DjbPT8PfLBZLyHloiD18mdTNYkNakxkzmIciGxvBEpOMcMMRHWPwQKx
xASKdafhXzyc2SYQgcid1c4eZiyCoqj73Vrbnrgd9hXLc9hWdlruTq6FZizqT11O
JpYh4tsRPCL8ewLWuOw82E74UXlsQOZDtTASHgoPwSq12zlC0ex3hgM5Eb9PSNLK
aHSfY99Eo9Vz0qt77Myy2JdRT/DP8nGWV6cw+Q3bShoN+0PkNm3bH77vCqWKIJoc
cQCzkmm7v26zUlsJ/Ko6WFkTUKWqd4uPlrUBVkS4ECNuzotR4ITKAfVmj19avOx4
zCOt+PX/tU39iiHsIEhm433VosL+kJLKnY3Q+t5tv3vOW0gjut1D6PKkONiozMr0
y8VTIy7NiRLgbArxU+kn/yaNYBFfxbmwJEJBz1rPNVcpqpqF3TpdEq42dyJxydAn
piTus0/Ogm7Wnroq/Njt
=x78V
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org
.
(Sun, 02 Jun 2013 08:01:04 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 19:02:02 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.