electrum: CVE-2018-1000022

Debian Bug report logs - #886683
electrum: CVE-2018-1000022

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Daniel Koszta <daniel.koszta@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: electrum: Security vulnerability in electrum

Date: Mon, 08 Jan 2018 23:18:37 +0100

Package: electrum
Version: 3.0.3-1
Severity: grave
Tags: security
Justification: user security hole

Dear Maintainer,

Many Electrum versions are vulnerable, see
https://github.com/spesmilo/electrum/issues/3374.

A new, fixed version is already available in debian unstable, but it
should be included in stable and testing as soon as possible.



-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (800, 'testing'), (500, 'stable'), (200, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.13.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=hu_HU.utf8, LC_CTYPE=hu_HU.utf8 (charmap=UTF-8), LANGUAGE=hu_HU.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages electrum depends on:
ii  python3           3.6.4-1
ii  python3-electrum  3.0.3-1

Versions of packages electrum recommends:
ii  python3-pyqt5  5.9.2+dfsg-1

Versions of packages electrum suggests:
pn  python3-btchip  <none>
pn  python3-trezor  <none>
pn  python3-zbar    <none>

-- no debconf information

Message #10 received at 886683@bugs.debian.org (full text, mbox, reply):

From: Tristan Seligmann <mithrandi@mithrandi.net>

To: Daniel Koszta <daniel.koszta@gmail.com>, 886683@bugs.debian.org

Subject: Re: [Pkg-bitcoin-devel] Bug#886683: electrum: Security vulnerability in electrum

Date: Tue, 09 Jan 2018 03:22:41 +0000

[Message part 1 (text/plain, inline)]

Control: found -1 2.4.2+dfsg1-1
Control: fixed -1 3.0.5-1

On Tue, 9 Jan 2018 at 00:21 Daniel Koszta <daniel.koszta@gmail.com> wrote:

> A new, fixed version is already available in debian unstable, but it
> should be included in stable and testing as soon as possible.
>

Unfortunately the version in stable is too old to be able to connect to the
current Electrum servers due to protocol incompatibilities; thus I do not
think there is a need to backport this fix to stable (if you are still
using this version successfully, it is most likely on an offline machine
that is not vulnerable to this exploit).

Testing should be updated shortly as nothing blocks the migration from
unstable: https://qa.debian.org/excuses.php?package=electrum

[Message part 2 (text/html, inline)]

Message #23 received at 886683@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Tristan Seligmann <mithrandi@mithrandi.net>

Cc: Daniel Koszta <daniel.koszta@gmail.com>, 886683@bugs.debian.org

Subject: Re: [Pkg-bitcoin-devel] Bug#886683: electrum: Security vulnerability in electrum

Date: Mon, 15 Jan 2018 21:17:55 +0100

On Tue, Jan 09, 2018 at 03:22:41AM +0000, Tristan Seligmann wrote:
> Control: found -1 2.4.2+dfsg1-1
> Control: fixed -1 3.0.5-1
> 
> On Tue, 9 Jan 2018 at 00:21 Daniel Koszta <daniel.koszta@gmail.com> wrote:
> 
> > A new, fixed version is already available in debian unstable, but it
> > should be included in stable and testing as soon as possible.
> >
> 
> Unfortunately the version in stable is too old to be able to connect to the
> current Electrum servers due to protocol incompatibilities; thus I do not
> think there is a need to backport this fix to stable (if you are still
> using this version successfully, it is most likely on an offline machine
> that is not vulnerable to this exploit).

Ok, I'll update the Debian Security Tracker accordingly, but we also should
remove the package in the next stable point release.
Can you please also file a bug? (reportbug release.debian.org -> "rm")

Cheers,
        Moritz

Message #28 received at 886683@bugs.debian.org (full text, mbox, reply):

From: Tristan Seligmann <mithrandi@mithrandi.net>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: Daniel Koszta <daniel.koszta@gmail.com>, 886683@bugs.debian.org

Subject: Re: Bug#886683: [Pkg-bitcoin-devel] Bug#886683: electrum: Security vulnerability in electrum

Date: Tue, 16 Jan 2018 06:56:19 +0000

[Message part 1 (text/plain, inline)]

On Mon, 15 Jan 2018 at 22:21 Moritz Mühlenhoff <jmm@inutil.org> wrote:

> Ok, I'll update the Debian Security Tracker accordingly, but we also should
> remove the package in the next stable point release.
> Can you please also file a bug? (reportbug release.debian.org -> "rm")
>

Yes, good point; I have filed this as #887412.

[Message part 2 (text/html, inline)]

Message #33 received at 886683@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Tristan Seligmann <mithrandi@mithrandi.net>, 886683@bugs.debian.org

Cc: Moritz Mühlenhoff <jmm@inutil.org>, Daniel Koszta <daniel.koszta@gmail.com>

Subject: Re: Bug#886683: [Pkg-bitcoin-devel] Bug#886683: electrum: Security vulnerability in electrum

Date: Tue, 16 Jan 2018 08:09:50 +0100

Hi,

On Tue, Jan 16, 2018 at 06:56:19AM +0000, Tristan Seligmann wrote:
> On Mon, 15 Jan 2018 at 22:21 Moritz Mühlenhoff <jmm@inutil.org> wrote:
> 
> > Ok, I'll update the Debian Security Tracker accordingly, but we also should
> > remove the package in the next stable point release.
> > Can you please also file a bug? (reportbug release.debian.org -> "rm")
> >
> 
> Yes, good point; I have filed this as #887412.

Does the same reasoning as well apply to the version in
oldstable/jessie? If so we might want to remove it from there as well
(just fill a second RM bug specific for the jessie version).

Regards,
Salvatore

Message #38 received at 886683@bugs.debian.org (full text, mbox, reply):

From: Tristan Seligmann <mithrandi@mithrandi.net>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 886683@bugs.debian.org, Moritz Mühlenhoff <jmm@inutil.org>, Daniel Koszta <daniel.koszta@gmail.com>

Subject: Re: Bug#886683: [Pkg-bitcoin-devel] Bug#886683: electrum: Security vulnerability in electrum

Date: Tue, 16 Jan 2018 07:33:50 +0000

[Message part 1 (text/plain, inline)]

On Tue, 16 Jan 2018 at 09:09 Salvatore Bonaccorso <carnil@debian.org> wrote:

> Hi,
>
> On Tue, Jan 16, 2018 at 06:56:19AM +0000, Tristan Seligmann wrote:
> > On Mon, 15 Jan 2018 at 22:21 Moritz Mühlenhoff <jmm@inutil.org> wrote:
> >
> > > Ok, I'll update the Debian Security Tracker accordingly, but we also
> should
> > > remove the package in the next stable point release.
> > > Can you please also file a bug? (reportbug release.debian.org -> "rm")
> > >
> >
> > Yes, good point; I have filed this as #887412.
>
> Does the same reasoning as well apply to the version in
> oldstable/jessie? If so we might want to remove it from there as well
> (just fill a second RM bug specific for the jessie version).
>

Done (#887415). The jessie version is too old to be affected by the
security issue, but otherwise has the same problem (cannot connect to the
network) as well as probably calculating fees for offline transacting that
are way too low for the current situation.

[Message part 2 (text/html, inline)]

Message #45 received at 886683@bugs.debian.org (full text, mbox, reply):

From: "Miss Melisa Mehmet" <melisa@vjf.cnrs.fr>

To: undisclosed-recipients:;

Subject: Proposal

Date: Sun, 18 Feb 2018 02:36:23 +0100

Hello Greetings to you i need your collaboration to invest in your region
i have some funds under my management please get back to me asap thanks

Regards
Melisa Mehmet

Message #50 received at 886683@bugs.debian.org (full text, mbox, reply):

From: melisa mehmet <christiane.seydou@cnrs.fr>

To: Recipients <christiane.seydou@cnrs.fr>

Subject: Proposal

Date: Wed, 21 Feb 2018 18:49:57 -0400

Hello

Greetings to you and everyone around you please did you get my previous email regarding my proposal ?
please let me know if we can work together on this.

Best Reagrds

Message #57 received at 886683-submitter@bugs.debian.org (full text, mbox, reply):

From: Tristan Seligmann <mithrandi@debian.org>

To: control@bugs.debian.org

Cc: 886683-submitter@bugs.debian.org

Subject: closing 886683

Date: Mon, 30 Jul 2018 03:34:33 +0200

close 886683 3.0.5-1
thanks

Send a report that this bug log contains spam.