util-linux: CVE-2024-28085: wall: escape sequence injection

Debian Bug report logs - #1067849
util-linux: CVE-2024-28085: wall: escape sequence injection

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: util-linux: CVE-2024-28085: wall: escape sequence injection

Date: Wed, 27 Mar 2024 17:13:34 +0100

Source: util-linux
Version: 2.39.3-11
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.38.1-5 
Control: found -1 2.36.1-8+deb11u1
Control: found -1 2.36.1-8
Control: found -1 2.33.1-0.1

Hi,

The following vulnerability was published for util-linux.

CVE-2024-28085[0]:
| escape sequence injection in wall


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-28085
    https://www.cve.org/CVERecord?id=CVE-2024-28085
[1] https://www.openwall.com/lists/oss-security/2024/03/27/5
[2] https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
[3] https://github.com/skyler-ferrante/CVE-2024-28085

Regards,
Salvatore

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-18-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)

Message #22 received at 1067849-submitter@bugs.debian.org (full text, mbox, reply):

From: Chris Hofstaedtler <noreply@salsa.debian.org>

To: 1067849-submitter@bugs.debian.org

Subject: Bug#1067849 marked as pending in util-linux

Date: Thu, 28 Mar 2024 07:15:28 +0000

Control: tag -1 pending

Hello,

Bug #1067849 in util-linux reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/util-linux/-/commit/839ff33b8002189411b679cc9ee99d1a99e099cb

------------------------------------------------------------------------
Add upstream patches to fix CVE-2024-28085

Closes: #1067849
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1067849

Send a report that this bug log contains spam.