Debian Bug report logs - #966464
opendmarc: CVE-2020-12460

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: opendmarc: CVE-2020-12460

Date: Tue, 28 Jul 2020 21:20:53 +0200

Source: opendmarc
Version: 1.4.0~beta1+dfsg-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/trusteddomainproject/OpenDMARC/issues/64
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
Control: found -1 1.3.2-6+deb10u1
Control: found -1 1.3.2-6

Hi,

The following vulnerability was published for opendmarc.

CVE-2020-12460[0]:
| OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper
| null termination in the function opendmarc_xml_parse that can result
| in a one-byte heap overflow in opendmarc_xml when parsing a specially
| crafted DMARC aggregate report. This can cause remote memory
| corruption when a '\0' byte overwrites the heap metadata of the next
| chunk and its PREV_INUSE flag.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-12460
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12460
[1] https://github.com/trusteddomainproject/OpenDMARC/issues/64

Regards,
Salvatore

Message #16 received at 966464-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 966464-close@bugs.debian.org

Subject: Bug#966464: fixed in opendmarc 1.4.0~beta1+dfsg-3

Date: Sat, 19 Sep 2020 08:37:57 +0000

Source: opendmarc
Source-Version: 1.4.0~beta1+dfsg-3
Done: =?utf-8?q?David_B=C3=BCrgin?= <dbuergin@gluet.ch>

We believe that the bug you reported is fixed in the latest version of
opendmarc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 966464@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Bürgin <dbuergin@gluet.ch> (supplier of updated opendmarc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 19 Sep 2020 08:40:47 +0200
Source: opendmarc
Architecture: source
Version: 1.4.0~beta1+dfsg-3
Distribution: unstable
Urgency: high
Maintainer: Scott Kitterman <scott@kitterman.com>
Changed-By: David Bürgin <dbuergin@gluet.ch>
Closes: 965284 966464
Changes:
 opendmarc (1.4.0~beta1+dfsg-3) unstable; urgency=high
 .
   * Cherry-pick patch for CVE-2020-12460 from upstream:
     - Add proper null-termination in opendmarc_xml_parse (Closes: #966464)
   * Shut down debconf with db_stop in opendmarc.postinst,
     patch by "B.R.S.Roso" <rici@roso93.net> (Closes: #965284)
   * Add missing DEP-3 headers tracking upstream bug in d/patches
Checksums-Sha1:
 e8af16bea41c757f86be3b801b10c32333bed90c 2178 opendmarc_1.4.0~beta1+dfsg-3.dsc
 862b4af23a3cfa4510ad7c43e2e16d2bc8d21712 26684 opendmarc_1.4.0~beta1+dfsg-3.debian.tar.xz
Checksums-Sha256:
 3f605f02ba0db8557c7a2e4cfd1b134cbdc3a0e0fdeeba0757a699d3a420d83d 2178 opendmarc_1.4.0~beta1+dfsg-3.dsc
 18ca960698b045ad43455f6ed76dc452eea3f18ca1f9901cc744f13105504e4d 26684 opendmarc_1.4.0~beta1+dfsg-3.debian.tar.xz
Files:
 bb19463587886163cad4c97a896cb345 2178 mail optional opendmarc_1.4.0~beta1+dfsg-3.dsc
 81ae45494833be2bcf0b1d930b197fd5 26684 mail optional opendmarc_1.4.0~beta1+dfsg-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZaEt9P4xrWusTXauM1X01jtYIcwFAl9lwa0ACgkQM1X01jtY
Icz1oxAAsptLm9qoxi4B6A7P+sYNyD8secV1S8I4l2wN6dk03c+dPG2IomjGRtJn
6KQA/1CjnXnmf3O2TDs7rP/wLVCrOwyXxfwFChOKD7CxJVgOwnRBanklKx4M+k0I
+p2RpQQJ8Nf9IhHfX0PwaDJRk488pSNfrqHLG7SlKuQmG7WGB8NctyrBIAjTnWOJ
o7rYNUP4DmXXwPIyk3/p3dOuXRvy0s0p2XuT778OEi/l7tkAjlqLO6ndDBHDaTNY
flCs2dHTXPQAqJAbcfe/jJgIaCL/S83qroBWztvve8Kx+L/z63X8aQG0fPgbUdoW
bBNm7P2+9MsahCWgemsjPJVXcdw+D9Np8TbaeSaAh+2/dxQlcTrheblPnIgd5ZnI
Qw9qnHwAOcPh3roC32UrKPr6aCoDSvTnTYoBIHEaj/NXF7zZpRivZiuTvsRnXtaM
+fHQ1tw/0n7Q201nVBQV3/iHSuWNE29uoilLWzHkztyBUe/puPhNgQsdsDCsUjQh
o3q3rQFH7bo9gXSSxPumj/o69+oLHpdvJrHkxecsUC/I3xLI+2Vw5JbCBDf7AyHA
UdybT7thrdcv2ORNOlqDJcbuW+qh1blizQS+aKJAPyVwbR4l6pZfPWsLgXhf2kUX
5bkKRpCNntvEngwoVm7J+Nh8vj59tMRzWZaG6LgI+DzdVLbTFu8=
=Ij71
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.