CVE-2015-5694 CVE-2015-5695

Related Vulnerabilities: CVE-2015-5694   CVE-2015-5695  

Debian Bug report logs - #796108
CVE-2015-5694 CVE-2015-5695

version graph

Reported by: Moritz Muehlenhoff <jmm@debian.org>

Date: Wed, 19 Aug 2015 14:12:14 UTC

Severity: grave

Tags: security

Found in version designate/2015.1.0-2

Fixed in versions designate/1:1.0.0~b2-1, designate/2015.1.0+2015.08.26.git34.9fa07c5798-1, designate/2014.1-18+deb8u1

Done: Thomas Goirand <zigo@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 14:12:17 GMT) (full text, mbox, link).


Acknowledgement sent to Moritz Muehlenhoff <jmm@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 14:12:17 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 16:11:00 +0200
Source: designate
Severity: grave
Tags: security

Hi,
please see the thread starting here:
https://marc.info/?l=oss-security&m=143810184926097&w=2

Can you please check with upstream whether 2014.1 from jessie
is affected, if so we should fix it.

Cheers,
        Moritz



Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 14:51:09 GMT) (full text, mbox, link).


Acknowledgement sent to Kiall Mac Innes <kiall@macinnes.ie>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 14:51:09 GMT) (full text, mbox, link).


Message #10 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Kiall Mac Innes <kiall@macinnes.ie>
To: Moritz Muehlenhoff <jmm@debian.org>, 796108@bugs.debian.org
Subject: Re: Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 09:41:29 -0500
[Message part 1 (text/plain, inline)]
Reworked patch, minus the tests.

The OpenStack/Designate project during icehouse did not cap 
requirements, causing the unit tests to fail to run.

I would recommend ensuring the tests pass given the set of dependencies 
in Jessie before applying and pushing.

Thanks,
Kiall

On 19/08/15 09:36, Kiall Mac Innes wrote:
> Hey - Upstream Designate maintainer here.
>
> Icehouse - aka 2014.1 - is partially affected by CVE-2015-5695, 
> failure to enforce recordset quotas.
>
> This was the less severe of the two CVEs, which we treated as a 
> feature not implemented rather than a security issue initially. 
> Additionally, the issue could only be exploited through the disabled 
> by default + marked experimental V2 API.
>
> Regardless - The patch at [1] should be easy enough to re-work for 
> Icehouse.
>
> Thanks,
> Kiall
>
> [1]: 
> https://launchpadlibrarian.net/211525408/bug-1471161-quotas-kilo.patch
>
> On 19/08/15 09:11, Moritz Muehlenhoff wrote:
>> Source: designate
>> Severity: grave
>> Tags: security
>>
>> Hi,
>> please see the thread starting here:
>> https://marc.info/?l=oss-security&m=143810184926097&w=2
>>
>> Can you please check with upstream whether 2014.1 from jessie
>> is affected, if so we should fix it.
>>
>> Cheers,
>>          Moritz
>>
>>
>

[Message part 2 (text/html, inline)]
[0001-Ensure-RecordSet-quotas-are-enforced.patch (text/x-patch, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 14:51:11 GMT) (full text, mbox, link).


Acknowledgement sent to Kiall Mac Innes <kiall@macinnes.ie>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 14:51:12 GMT) (full text, mbox, link).


Message #15 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Kiall Mac Innes <kiall@macinnes.ie>
To: Moritz Muehlenhoff <jmm@debian.org>, 796108@bugs.debian.org
Subject: Re: Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 09:36:14 -0500
[Message part 1 (text/plain, inline)]
Hey - Upstream Designate maintainer here.

Icehouse - aka 2014.1 - is partially affected by CVE-2015-5695, failure 
to enforce recordset quotas.

This was the less severe of the two CVEs, which we treated as a feature 
not implemented rather than a security issue initially. Additionally, 
the issue could only be exploited through the disabled by default + 
marked experimental V2 API.

Regardless - The patch at [1] should be easy enough to re-work for Icehouse.

Thanks,
Kiall

[1]: https://launchpadlibrarian.net/211525408/bug-1471161-quotas-kilo.patch

On 19/08/15 09:11, Moritz Muehlenhoff wrote:
> Source: designate
> Severity: grave
> Tags: security
>
> Hi,
> please see the thread starting here:
> https://marc.info/?l=oss-security&m=143810184926097&w=2
>
> Can you please check with upstream whether 2014.1 from jessie
> is affected, if so we should fix it.
>
> Cheers,
>          Moritz
>
>

[Message part 2 (text/html, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 15:09:12 GMT) (full text, mbox, link).


Acknowledgement sent to Moritz Mühlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 15:09:12 GMT) (full text, mbox, link).


Message #20 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>
To: Kiall Mac Innes <kiall@macinnes.ie>
Cc: 796108@bugs.debian.org
Subject: Re: Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 17:05:06 +0200
On Wed, Aug 19, 2015 at 09:36:14AM -0500, Kiall Mac Innes wrote:
> Hey - Upstream Designate maintainer here.
> 
> Icehouse - aka 2014.1 - is partially affected by CVE-2015-5695, failure to
> enforce recordset quotas.

Thanks.

I'm more worried about CVE-2015-5694, is icehouse by that one?

Cheers,
        Moritz



Marked as found in versions designate/2015.1.0-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 19 Aug 2015 15:18:03 GMT) (full text, mbox, link).


Marked as fixed in versions designate/1:1.0.0~b2-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 19 Aug 2015 15:18:04 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 17:27:04 GMT) (full text, mbox, link).


Acknowledgement sent to Graham Hayes <graham@hayes.ie>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 17:27:04 GMT) (full text, mbox, link).


Message #29 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Graham Hayes <graham@hayes.ie>
To: 796108@bugs.debian.org, Moritz Mühlenhoff <jmm@inutil.org>
Cc: Kiall Mac Innes <kiall@macinnes.ie>
Subject: Re: Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 18:24:39 +0100
[Message part 1 (text/plain, inline)]
Ice house was not vulnerable to CVE-2015-5694 , as the affected designate
component didn't exist during icehouse.
On 19 Aug 2015 10:09 am, "Moritz Mühlenhoff" <jmm@inutil.org> wrote:

> On Wed, Aug 19, 2015 at 09:36:14AM -0500, Kiall Mac Innes wrote:
> > Hey - Upstream Designate maintainer here.
> >
> > Icehouse - aka 2014.1 - is partially affected by CVE-2015-5695, failure
> to
> > enforce recordset quotas.
>
> Thanks.
>
> I'm more worried about CVE-2015-5694, is icehouse by that one?
>
> Cheers,
>         Moritz
>
>
>
[Message part 2 (text/html, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Wed, 19 Aug 2015 18:30:06 GMT) (full text, mbox, link).


Acknowledgement sent to Moritz Mühlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Wed, 19 Aug 2015 18:30:06 GMT) (full text, mbox, link).


Message #34 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>
To: Graham Hayes <graham@hayes.ie>
Cc: 796108@bugs.debian.org, Kiall Mac Innes <kiall@macinnes.ie>
Subject: Re: Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Wed, 19 Aug 2015 20:28:15 +0200
On Wed, Aug 19, 2015 at 06:24:39PM +0100, Graham Hayes wrote:
> Ice house was not vulnerable to CVE-2015-5694 , as the affected designate
> component didn't exist during icehouse.

Thanks, I've updated the Debian security tracker.

Cheers,
        Moritz



Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Fri, 21 Aug 2015 12:48:06 GMT) (full text, mbox, link).


Acknowledgement sent to Thomas Goirand <zigo@debian.org>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Fri, 21 Aug 2015 12:48:06 GMT) (full text, mbox, link).


Message #39 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>
To: Graham Hayes <graham@hayes.ie>
Cc: Kiall Mac Innes <kiall@macinnes.ie>, 796108@bugs.debian.org, security@debian.org
Subject: Re: [PKG-Openstack-devel] Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Fri, 21 Aug 2015 14:44:49 +0200
On 08/19/2015 08:28 PM, Moritz Mühlenhoff wrote:
> On Wed, Aug 19, 2015 at 06:24:39PM +0100, Graham Hayes wrote:
>> Ice house was not vulnerable to CVE-2015-5694 , as the affected designate
>> component didn't exist during icehouse.
> 
> Thanks, I've updated the Debian security tracker.
> 
> Cheers,
>         Moritz

Hi Moritz,

Should I prepare a security upload for Jessie, or do it through the
release team oversight?

I'll do the Sid/Testing updates when I come back home next week.

Cheers,

Thomas Goirand (zigo)




Information forwarded to debian-bugs-dist@lists.debian.org, PKG OpenStack <openstack-devel@lists.alioth.debian.org>:
Bug#796108; Package src:designate. (Tue, 25 Aug 2015 07:39:07 GMT) (full text, mbox, link).


Acknowledgement sent to Sébastien Delafond <seb@debian.org>:
Extra info received and forwarded to list. Copy sent to PKG OpenStack <openstack-devel@lists.alioth.debian.org>. (Tue, 25 Aug 2015 07:39:07 GMT) (full text, mbox, link).


Message #44 received at 796108@bugs.debian.org (full text, mbox, reply):

From: Sébastien Delafond <seb@debian.org>
To: Thomas Goirand <zigo@debian.org>
Cc: Graham Hayes <graham@hayes.ie>, Kiall Mac Innes <kiall@macinnes.ie>, 796108@bugs.debian.org, security@debian.org
Subject: Re: [PKG-Openstack-devel] Bug#796108: CVE-2015-5694 CVE-2015-5695
Date: Tue, 25 Aug 2015 09:26:24 +0200
On Aug/21, Thomas Goirand wrote:
> Should I prepare a security upload for Jessie, or do it through the
> release team oversight?

Hi Thomas,

CVE-2015-5695 is not that severe, so this should go through a PU
request. I'll mark the issue as no-dsa in the tracker.

Cheers,

--Seb



Reply sent to Thomas Goirand <zigo@debian.org>:
You have taken responsibility. (Wed, 26 Aug 2015 10:27:12 GMT) (full text, mbox, link).


Notification sent to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer. (Wed, 26 Aug 2015 10:27:12 GMT) (full text, mbox, link).


Message #49 received at 796108-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>
To: 796108-close@bugs.debian.org
Subject: Bug#796108: fixed in designate 2015.1.0+2015.08.26.git34.9fa07c5798-1
Date: Wed, 26 Aug 2015 10:24:45 +0000
Source: designate
Source-Version: 2015.1.0+2015.08.26.git34.9fa07c5798-1

We believe that the bug you reported is fixed in the latest version of
designate, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 796108@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated designate package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 26 Aug 2015 07:23:26 +0000
Source: designate
Binary: python-designate designate-common designate designate-api designate-central designate-agent designate-sink designate-mdns designate-pool-manager designate-doc
Architecture: source all
Version: 2015.1.0+2015.08.26.git34.9fa07c5798-1
Distribution: unstable
Urgency: high
Maintainer: PKG OpenStack <openstack-devel@lists.alioth.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 designate  - OpenStack DNS as a Service - metapackage
 designate-agent - OpenStack DNS as a Service - agent
 designate-api - OpenStack DNS as a Service - API server
 designate-central - OpenStack DNS as a Service - central daemon
 designate-common - OpenStack DNS as a Service - common files
 designate-doc - OpenStack DNS as a Service - doc
 designate-mdns - OpenStack DNS as a Service - mdns
 designate-pool-manager - OpenStack DNS as a Service - pool manager
 designate-sink - OpenStack DNS as a Service - sink
 python-designate - OpenStack DNS as a Service - Python libs
Closes: 796108
Changes:
 designate (2015.1.0+2015.08.26.git34.9fa07c5798-1) unstable; urgency=high
 .
   * New upstream release based on commit 34.9fa07c5798. This fixes
     CVE-2015-5694 and CVE-2015-5695 (Closes: #796108).
   * Fixed min versions of neutronclient and oslo.concurrency.
Checksums-Sha1:
 92db4133413c6103f6aee44ae39b6ad3cea5b792 3939 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.dsc
 c636fbd040e14342a535a4a91aec1e5e405cdc24 425632 designate_2015.1.0+2015.08.26.git34.9fa07c5798.orig.tar.xz
 c27e66c10a14c034297d11340b12b42ce1fe9526 14356 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.debian.tar.xz
 4b8e5819ad03e9bb7da196ba74d2028bd61bd2cf 6168 designate-agent_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 25f7ecd11f124018413c867565390e5254bb7651 15960 designate-api_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 bf53091a64da84e4513a7414e7bdbbfabcf8de3f 6168 designate-central_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 9d0a36338403905a8993036d317049b8e80debcc 19420 designate-common_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 a205fe3cfd673c788f735f4e86c9991e67852bd6 232362 designate-doc_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 8c37feadfacef50287c2de231e5a5a930c378998 6152 designate-mdns_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 19ab6405696fb0980d235e4d48b7abef11db2667 6168 designate-pool-manager_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 5393b50ffdd5cfd8730531556c7d8ff3857b0981 6152 designate-sink_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 065e9d92be7c95b69849500a9336aedf05fc2a63 3454 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 811059fa6cf87640e7254fb6703d6a1bdd246e31 208402 python-designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
Checksums-Sha256:
 95e86ce32b5dbf50ec20b00783b04dfa13b9c90a49af8dfb22463158c610bfc7 3939 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.dsc
 ec403caad46413c15877137628ca55be10b9f28590e487476c198c437f6b382f 425632 designate_2015.1.0+2015.08.26.git34.9fa07c5798.orig.tar.xz
 a932bf393880c4b7a407e683605a30a1f2166be1a9015e8fbc0d529e71799eae 14356 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.debian.tar.xz
 d9ecc26a125f736ce502c39db0beede3b83805bb97c9fb02b7eaec32df2dc693 6168 designate-agent_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 6763d48e062ca77cd2a99161b81fda289b0c64b17b11a002296dae62f13a0b68 15960 designate-api_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 d492a7fb72dccbc49bf1d37fed13a948d2aef7e3fa7813c75b55c8b434c978fc 6168 designate-central_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 ae1664c8625ed1f83fde7abf153487607a15a9fa67df3de9d77b5c537665b46e 19420 designate-common_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 7c738691f95800eac96fb91fbb6471796c176b53dc99f339ede67bc7c851d08f 232362 designate-doc_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 8529697fe58a2c2005bde7ca4921221e83c8a9a880f2cdf464bb8818dc132e0e 6152 designate-mdns_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 1f834dc9525c2c104ecca48d32db604c4f034c86e0ccdfe7da3d0ae326e39af7 6168 designate-pool-manager_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 c6a5f1f296115776b53e89ab9691786cf4f35d9166cdd3276eafff3ce07884db 6152 designate-sink_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 caa1182472879c9119d763796e4780ec9066fae85961acb9d596062147280b00 3454 designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 05ffd29bd6bb21356930eec09181f806cc9b16006b082179d844be31e60a6d53 208402 python-designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
Files:
 64108c7be7e747104a39296bda0b1655 3939 net extra designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.dsc
 d380c7ea07bc00a38511cc2c2d244e36 425632 net extra designate_2015.1.0+2015.08.26.git34.9fa07c5798.orig.tar.xz
 28168aecf33a53119c96e11d9155ffd7 14356 net extra designate_2015.1.0+2015.08.26.git34.9fa07c5798-1.debian.tar.xz
 e9c463b68d7a970e442c719434e600a2 6168 net extra designate-agent_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 6571f26c681ef730f03a67c759fb4a75 15960 net extra designate-api_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 165bcd820fd399307b490d44d33884ff 6168 net extra designate-central_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 34e122d910e6e7e98751558a35e5940d 19420 net extra designate-common_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 c13e86b11aecc795f3040bff0c53c353 232362 doc extra designate-doc_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 1fc286c40c2e7c49a7df8e9f57ac5861 6152 net extra designate-mdns_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 7b4990c51e5b3145220b6ec97eb8f5a8 6168 net extra designate-pool-manager_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 ea26a46c1d40a9e45d544c1d5f32e736 6152 net extra designate-sink_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 976ff0f4502b8ad03dc0b09874e8df33 3454 net extra designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb
 e9a293124b2bc0929b5eff92df9403f0 208402 python extra python-designate_2015.1.0+2015.08.26.git34.9fa07c5798-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJV3XPrAAoJENQWrRWsa0P+QXEQAJjJeWnmgSLJBJJRBPv6v7ET
rhOA0ym6pLHmI5xbDGussQc1sKSe70w9CXjBN5naJqI1AWwXBpB+wdfuRKs/QrWR
LLYbtlBFeYMqsoqQ0q86gptlY7J0JA3Zxpwk0/5XwgmbTo0Tj6F2KpPMWHvquXOT
BTNsAf0Wfvclrg/ZHq+msOQX4aMSGAlpmgbVY2e0D+ZYe9CL/5qt8/bj+NtKYfTQ
KarndIjYCuK5+dAxIS88WLWY4xCIZPZQVOPZrO8j2teHtlvnchor2vOfjOVlO8Sy
+Y+/0Mc+bJ3oRJAvMSYiIxtkLHmzkFnlxWGS79lwZ9Vxv8Ygh9SL5Ua3SGC5pabA
chPwwi2KwJABa5YMhhifL505sr4PZBmZwbSpUkGR0tkgM2WF9tI3p/6qt6ogfbou
/ooVP2SvTnpfpnIrAGCxUCtVC1w3WtlXNoz5zUvla5PsvEd8HaAUdJZEjroNn4iU
GD1GmLikSahvEm72upxbskGe00xVObfUS/902fqG/SdKL+MgUwqk3YcCJxBbYYnF
qKUVmaKZ16dM6TcyXYVEGQpPSmCw+0K9dGOEMhvr3NcgwybCm9riGYW3k1RMlExf
PctPjElKe0AD35VvnmJyskT5/mrruIofWnNhvKg5cRWwQuxdobMhF0qdvrW0IGC0
ZlByhVEK0UQVqi5oOxXt
=aq4p
-----END PGP SIGNATURE-----




Reply sent to Thomas Goirand <zigo@debian.org>:
You have taken responsibility. (Sat, 29 Aug 2015 10:36:15 GMT) (full text, mbox, link).


Notification sent to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer. (Sat, 29 Aug 2015 10:36:15 GMT) (full text, mbox, link).


Message #54 received at 796108-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>
To: 796108-close@bugs.debian.org
Subject: Bug#796108: fixed in designate 2014.1-18+deb8u1
Date: Sat, 29 Aug 2015 10:32:12 +0000
Source: designate
Source-Version: 2014.1-18+deb8u1

We believe that the bug you reported is fixed in the latest version of
designate, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 796108@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated designate package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 26 Aug 2015 11:04:54 +0200
Source: designate
Binary: python-designate designate-common designate designate-api designate-central designate-agent designate-sink designate-doc
Architecture: source all
Version: 2014.1-18+deb8u1
Distribution: jessie-proposed-updates
Urgency: medium
Maintainer: PKG OpenStack <openstack-devel@lists.alioth.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 designate  - OpenStack DNS as a Service - metapackage
 designate-agent - OpenStack DNS as a Service - agent
 designate-api - OpenStack DNS as a Service - API server
 designate-central - OpenStack DNS as a Service - central daemon
 designate-common - OpenStack DNS as a Service - common files
 designate-doc - OpenStack DNS as a Service - doc
 designate-sink - OpenStack DNS as a Service - sink
 python-designate - OpenStack DNS as a Service - Python libs
Closes: 796108
Changes:
 designate (2014.1-18+deb8u1) jessie-proposed-updates; urgency=medium
 .
   * CVE-2015-5695: mDNS DoS through incorrect handling of large RecordSets:
     applied upstream patch (Closes: #796108).
Checksums-Sha1:
 563ff73a626c07089b92e618180700c7d519a8f4 3543 designate_2014.1-18+deb8u1.dsc
 b388d85368dfad295ec0cf08ac037ea91541084b 15936 designate_2014.1-18+deb8u1.debian.tar.xz
 95faa42edfbc6c6ddf8d043d201a2e4c144d50fa 209418 python-designate_2014.1-18+deb8u1_all.deb
 f7a80c4b5e88adff18a6b450d308a28600db28b3 28454 designate-common_2014.1-18+deb8u1_all.deb
 bb2c2eade065932f6f1e5f9ddbbf227377dd29c2 3508 designate_2014.1-18+deb8u1_all.deb
 d6487159159adcb229c17555f57fc142dd5275fb 25482 designate-api_2014.1-18+deb8u1_all.deb
 3e44617c33bf4268556379c2f3617e0d06d420b4 6224 designate-central_2014.1-18+deb8u1_all.deb
 534b83e242c243b8bd9e61148bc25ff331bf34ac 6218 designate-agent_2014.1-18+deb8u1_all.deb
 7146dff5a09ba05a9e6a105ca51dce5410313842 6208 designate-sink_2014.1-18+deb8u1_all.deb
 8d5bb7263f9e589b554a666585e44757b658279d 136280 designate-doc_2014.1-18+deb8u1_all.deb
Checksums-Sha256:
 d7f869c835b62f97348499b4487961eca99b4ba716776ab94ed0cf789ab854a8 3543 designate_2014.1-18+deb8u1.dsc
 379677fc22ca54524cfd7c33efbe2fe3c76a36776c1f167c3d83b969c8749e7c 15936 designate_2014.1-18+deb8u1.debian.tar.xz
 81d0e1b6f3ed425376511fc26cecee0bf33815a358d31711b6a9748c8bf794f9 209418 python-designate_2014.1-18+deb8u1_all.deb
 f8c9715253da266d9ce679588ecc0bd058f22d5db1206cedfd9bc92cdc0eb92b 28454 designate-common_2014.1-18+deb8u1_all.deb
 609a7da5441d681719daf111d3373def2c893cac453f25959d32eb7953aeb3d1 3508 designate_2014.1-18+deb8u1_all.deb
 d84a48e21e4629ea20ca39f2e4d220b56a47143267046c574db98d0c3d66a2fc 25482 designate-api_2014.1-18+deb8u1_all.deb
 d5aac55722dd81e01ac541d964f9a5bc165061e991c46a21fc942e50608294fe 6224 designate-central_2014.1-18+deb8u1_all.deb
 b466425ecd037457e540ca4e9b70043920cf414aa7531ef2c99ddde50d8d8956 6218 designate-agent_2014.1-18+deb8u1_all.deb
 7994d091adc859c4c670b02d6e59002e6599eaacf0441f153b2c352adfe07809 6208 designate-sink_2014.1-18+deb8u1_all.deb
 add3ec3d24179d6c63c03ac074a6b1d128902433d52cf561e0d23febef538deb 136280 designate-doc_2014.1-18+deb8u1_all.deb
Files:
 0f9d9556cbe7525da2db26a13ea0d5ff 3543 net extra designate_2014.1-18+deb8u1.dsc
 8cf811f3b987da9daa55d7277f97adb4 15936 net extra designate_2014.1-18+deb8u1.debian.tar.xz
 6a067d0bbe58bbffbd3a0436d7e4d3e6 209418 python extra python-designate_2014.1-18+deb8u1_all.deb
 1ad9831de957d6c4caff82c0a8626d26 28454 net extra designate-common_2014.1-18+deb8u1_all.deb
 8bea1d40effdca47ea3c92c3a8610935 3508 net extra designate_2014.1-18+deb8u1_all.deb
 cc0e5aa768812ad6ed5b9342d61d19b6 25482 net extra designate-api_2014.1-18+deb8u1_all.deb
 197079ce97d965a700bde5f30e3163ef 6224 net extra designate-central_2014.1-18+deb8u1_all.deb
 92de8ecb82ae6a7c0558a173f9b3e5bb 6218 net extra designate-agent_2014.1-18+deb8u1_all.deb
 50fe04e2b135d4980be2b0ba4299b4e6 6208 net extra designate-sink_2014.1-18+deb8u1_all.deb
 58702b8cfa7bd63733c3fc04e8e37e1a 136280 doc extra designate-doc_2014.1-18+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJV3bE7AAoJENQWrRWsa0P+EEgP/2u8G74oy/hkyRgK3jTtL+JA
K+GCrljj160mCR6O0kGzb6Ai9Kk85yyYRxan/ngs8wxpM/RyLTgFKydURK3AlTmx
htzw61PBERUCNgcwQ3rZQfB4ox00m9iHQiddd6QNvQjqZEPTNua4ax37Xhgxa3yf
Or66Tm0LqNCBmXmhF88flSrNcS+uZCium2njoxQ4gkoMcf0LqwK2AP2LdrYdwNDJ
1wSsazhHrXOZlbv9ohT3qOGX25yLrGsSDXEFAaKFNKl7130velgLX7nwHcgUlaxW
d/xPNmlx4ahZ4jxNlwx/7FHiG79q5geQZ2DEpjJnsBpby/DqnjswoRjS5hkDcisW
vypsJeuRtvR/Ev+xA6k5YVSgd9ZYmmugk8gs6BUEWeSi3v5PRbX/vF6zI/zLe2CO
HZf2bnsCBfSiCFuU5o8JEYViOEBxYWcBR4MIc7xLl2AzCPbSonCoeqa2s/elb4qL
1z5/eYv5+0of0sp4ML3LM6XJqhfck+swcfj2nlpPcfh/5X7j5lAmoue9t5MUMUjH
AY1OGAYEFCVIEWnfqIh5UzPR+QXRhLp/kIjmk8u9Vpv5J0b1f+D3H9iz3vBuk4Z1
CzKejUqHUASCwK7f+uTQTrBUCBV7nrSMFHid0jfEAbwKVHJ+WN9TWoA83x/8Sb21
3gsUF4Lddh5GCROfhSpE
=ntXx
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 27 Sep 2015 07:25:20 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 18:44:40 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.