openconnect: buffer overflow in certificate handling (CVE-2020-12823)

Debian Bug report logs - #960620
openconnect: buffer overflow in certificate handling (CVE-2020-12823)

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <bluca@debian.org>

To: "submit@bugs.debian.org" <submit@bugs.debian.org>

Subject: openconnect: buffer overflow in certificate handling (CVE-2020-12823)

Date: Thu, 14 May 2020 18:50:57 +0100

[Message part 1 (text/plain, inline)]

Package: openconnect
Version: 6.00-1
Severity: important
Tags: security

Openconnect is affected by a buffer overflow in certificate handling,
that goes back at least to 6.00-1 (old-old-stable).

Fixed upstream by:

https://gitlab.com/openconnect/openconnect/-/merge_requests/108

-- 
Kind regards,
Luca Boccassi

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 960620-submitter@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <noreply@salsa.debian.org>

To: 960620-submitter@bugs.debian.org

Subject: Bug#960620 marked as pending in openconnect

Date: Thu, 14 May 2020 18:18:12 +0000

Control: tag -1 pending

Hello,

Bug #960620 in openconnect reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/openconnect/-/commit/6a08dff61901e6cf1ff1f1840f3af97f4b10bbfc

------------------------------------------------------------------------
Backport patch to fix CVE-2020-12823

Closes: #960620
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/960620

Message #25 received at 960620@bugs.debian.org (full text, mbox, reply):

From: Luca Boccassi <bluca@debian.org>

To: 960620@bugs.debian.org

Cc: security@debian.org

Subject: Re: openconnect: buffer overflow in certificate handling (CVE-2020-12823)

Date: Thu, 14 May 2020 22:57:44 +0100

[Message part 1 (text/plain, inline)]

On Thu, 2020-05-14 at 18:50 +0100, Luca Boccassi wrote:
> Package: openconnect
> Version: 6.00-1
> Severity: important
> Tags: security
> 
> Openconnect is affected by a buffer overflow in certificate handling,
> that goes back at least to 6.00-1 (old-old-stable).
> 
> Fixed upstream by:
> 
> https://gitlab.com/openconnect/openconnect/-/merge_requests/108

Dear security team,

I uploaded to old-old-stable on request from the LTS team. How would
you like to handle stable and old-stable?

-- 
Kind regards,
Luca Boccassi

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.