connman: CVE-2021-33833: dnsproxy: Check the length of buffers before memcpy

Debian Bug report logs - #989662
connman: CVE-2021-33833: dnsproxy: Check the length of buffers before memcpy

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: connman: CVE-2021-33833: dnsproxy: Check the length of buffers before memcpy

Date: Wed, 09 Jun 2021 19:16:39 +0200

Source: connman
Version: 1.36-2.1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.36-2.1~deb10u1

Hi,

The following vulnerability was published for connman. Choosing RC
severity to make sure the fix land in bullseye.

CVE-2021-33833[0]:
| dnsproxy: Check the length of buffers before memcpy

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-33833
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33833
[1] https://www.openwall.com/lists/oss-security/2021/06/09/1
[2] https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=eceb2e8d2341c041df55a5e2f047d9a8c491463c

Regards,
Salvatore

Message #12 received at 989662@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 989662@bugs.debian.org

Cc: Alf Gaida <agaida@siduction.org>

Subject: connman: diff for NMU version 1.36-2.2

Date: Wed, 9 Jun 2021 21:05:29 +0200

[Message part 1 (text/plain, inline)]

Control: tags 989662 + patch
Control: tags 989662 + pending


Dear maintainer,

I've prepared an NMU for connman (versioned as 1.36-2.2) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Alf, this is sort of not respecting the rules for NMU, my goal here
would be to make it possible to make as well an update for buster in
time. So if you agree I would even shorten the delay.

If you want to override the upload this is obviously perfectly fine!

Regards,
Salvatore

[connman-1.36-2.2-nmu.diff (text/x-diff, attachment)]

Send a report that this bug log contains spam.