rsync: CVE-2014-9512

Debian Bug report logs - #778333
rsync: CVE-2014-9512

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2014-9512

Date: Fri, 13 Feb 2015 17:55:46 +0100

Package: rsync
Version: 3.1.1-2+b1
Severity: important
Tags: security

This was assigned CVE-2014-9512:
http://xteam.baidu.com/?p=169

Patch is here:
https://git.samba.org/?p=rsync.git;a=commit;h=962f8b90045ab331fc04c9e65f80f1a53e68243b

It would be nice if we could still get this into jessie with a
targeted fix / unblock.

Cheers,
        Moritz

Message #14 received at 778333@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 778333@bugs.debian.org

Subject: Re: CVE-2014-9512

Date: Thu, 5 Mar 2015 22:02:57 +0100

On Fri, Feb 13, 2015 at 05:55:46PM +0100, Moritz Muehlenhoff wrote:
> Package: rsync
> Version: 3.1.1-2+b1
> Severity: important
> Tags: security
> 
> This was assigned CVE-2014-9512:
> http://xteam.baidu.com/?p=169
> 
> Patch is here:
> https://git.samba.org/?p=rsync.git;a=commit;h=962f8b90045ab331fc04c9e65f80f1a53e68243b
> 
> It would be nice if we could still get this into jessie with a
> targeted fix / unblock.

Could you upload a fixed package?

Cheers,
        Moritz

Message #19 received at 778333@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Paul Slootman <paul@debian.org>

Cc: Moritz Mühlenhoff <jmm@inutil.org>, 778333@bugs.debian.org

Subject: Re: Bug#778333: CVE-2014-9512

Date: Sat, 7 Mar 2015 16:43:38 +0100

Hi Paul,

Thanks for the fix into unstable,
https://tracker.debian.org/news/674517 . Could you please as well ask
the release team for the unblock, so that the fix can go in in jessie
as well?

Regards,
Salvatore

Message #24 received at 778333-close@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: 778333-close@bugs.debian.org

Subject: Bug#778333: fixed in rsync 3.1.1-3

Date: Sat, 07 Mar 2015 15:37:03 +0000

Source: rsync
Source-Version: 3.1.1-3

We believe that the bug you reported is fixed in the latest version of
rsync, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 778333@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Slootman <paul@debian.org> (supplier of updated rsync package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 07 Mar 2015 15:45:05 +0100
Source: rsync
Binary: rsync
Architecture: source amd64
Version: 3.1.1-3
Distribution: unstable
Urgency: medium
Maintainer: Paul Slootman <paul@debian.org>
Changed-By: Paul Slootman <paul@debian.org>
Description:
 rsync      - fast, versatile, remote (and local) file-copying tool
Closes: 778333
Changes:
 rsync (3.1.1-3) unstable; urgency=medium
 .
   * Added patch for CVE-2014-9512, Rsync path spoofing attack vulnerability.
     closes:#778333
Checksums-Sha1:
 0041879c614eb91a4b19af04db93d9e4d414b32e 1676 rsync_3.1.1-3.dsc
 d762d84817fa06ed43d6dc15b64be8a9235b54b5 21968 rsync_3.1.1-3.debian.tar.xz
 59860e09b6e0e843ed680769914d728d8110f98a 389702 rsync_3.1.1-3_amd64.deb
Checksums-Sha256:
 1ca6cc2c514d6e82dfde28c3984bea8651f8c197640cbc05aa544c46d2891a69 1676 rsync_3.1.1-3.dsc
 be77fe6d9932e82c4215f6fcd127f813c667d50662a1416be5f4cd854c19c960 21968 rsync_3.1.1-3.debian.tar.xz
 e9d160978c317b689f6031d51b729d79a342e545e4403615f2a8113d61a141dc 389702 rsync_3.1.1-3_amd64.deb
Files:
 0162fcf4775af91e9c8c96a95a146141 1676 net optional rsync_3.1.1-3.dsc
 2a65abafc829cc1e38f2b665701cab2b 21968 net optional rsync_3.1.1-3.debian.tar.xz
 47a2bc9d1b06af8e470906957b658be1 389702 net optional rsync_3.1.1-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJU+xAvAAoJEDL3jc6tETuLjWwP/RdCWvmuIK2P1gthR9nP7Zje
XaS1oJ4x7XurSB0d8MnZ8OlMJr2Y6q/rWCGM24+0m/Gd2Ra/G6IPV33lj7e0zq4z
+hoCNEH8uKQxHYGjW5gReNP2mV4MvrTFlju09lFgTa+CeWhFx96ldi10RYx+Z0Ni
2nIrcavghMFOMb20B9IXD4pE9WMdVKSWez0v8xbZbZvMB/4SbbtL/lpQNf50gCET
5kYQxnq5HYkN2hnURwDRHbYmgO5j5DqHg/sfPxImfg5IktbrOn0aKwbywSUyq0f7
IYjkJmc6IaHxq+UJj7U7bnw7IU4i9tSLA986vCXrMp3cCzkkOgcQf5Ua/W8D5Xk1
dSyZcoUrRusN4/C4qw3GFeFtkAy6vw0Qn6z89ar7zG9Pdf49xsS+auUgOgHv5BzH
VhPEd5SpwqUlIP+W7Jn1fAaPzLY5sxsZWZ56i/aFyqfPi4GnBGuYi5cmeOTX4WUH
hfHhE98k9KUyBTz11QGNhSX/ihFdCuo7HTCdfzBE4BfIA4MVBm42aUFG980qEnbz
RcI6eaeALj9PVzoUQBhdesSqXeqcvEWXe3VbP5ORsEdfrlCJTVgCKA+kkiOD/mUs
SBqiLEUizy2A+lSQ96zSFf4n8gEapD0EXPj1icOc4iKwkX0tQEkV+3ja0GseDLsw
mCtDMowf7p3H6mEvQzJh
=c7zt
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.