538132 – <net-proxy/squid-3.4.11-r1: Nonce replay vulnerability in Digest authentication

Bug 538132 - <net-proxy/squid-3.4.11-r1: Nonce replay vulnerability in Digest authentication

Summary: <net-proxy/squid-3.4.11-r1: Nonce replay vulnerability in Digest authentication

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.redhat.com/show_bug....
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:
Blocks:	538612
	Show dependency tree

Reported:	2015-01-29 10:52 UTC by Agostino Sarubbo
Modified:	2015-03-07 12:12 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2015-01-29 10:52:14 UTC

From ${URL} :

Upstream fixed a security issue in digest_authentication [1] that can allow disabled user or users 
with changed password to access the squid service with old credentials.
Upstream patch for Squid 3.4: http://bazaar.launchpad.net/~squid/squid/3.4/revision/13211
Upstream patch for Squid 3.5: http://bazaar.launchpad.net/~squid/squid/3.5/revision/13735

[1]: http://bugs.squid-cache.org/show_bug.cgi?id=4066



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Eray Aslan gentoo-dev

2015-02-04 16:12:45 UTC

+*squid-3.4.11-r1 (04 Feb 2015)
+*squid-3.5.1-r1 (04 Feb 2015)
+
+  04 Feb 2015; Eray Aslan <eras@gentoo.org> +files/squid-13211_13210.patch,
+  +files/squid-13735_13734.patch, +squid-3.4.11-r1.ebuild,
+  +squid-3.5.1-r1.ebuild:
+  Security bump
+

Arches, please test and mark stable =net-proxy/squid-3.4.11-r1.  Thank you.

Comment 2 Jeroen Roovers (RETIRED) gentoo-dev

2015-02-05 01:34:43 UTC

Arch teams, please test and mark stable:
=net-proxy/squid-3.4.11-r1
Targeted stable KEYWORDS : alpha amd64 arm hppa ia64 ppc ppc64 sparc x86

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev

2015-02-05 11:35:38 UTC

Stable for HPPA.

Comment 4 Agostino Sarubbo gentoo-dev

2015-02-06 11:33:46 UTC

amd64 stable

Comment 5 Agostino Sarubbo gentoo-dev

2015-02-06 11:35:27 UTC

x86 stable

Comment 6 Markus Meier gentoo-dev

2015-02-08 21:14:14 UTC

arm stable

Comment 7 Agostino Sarubbo gentoo-dev

2015-02-16 10:23:27 UTC

sparc stable

Comment 8 Agostino Sarubbo gentoo-dev

2015-02-18 08:52:32 UTC

ppc64 stable

Comment 9 Agostino Sarubbo gentoo-dev

2015-02-18 09:17:57 UTC

ppc stable

Comment 10 Agostino Sarubbo gentoo-dev

2015-02-23 11:38:10 UTC

ia64 stable

Comment 11 Agostino Sarubbo gentoo-dev

2015-02-24 10:59:23 UTC

alpha stable.

Maintainer(s), please cleanup.
Security, please vote.

Comment 12 Sergey Popov gentoo-dev

2015-03-07 11:36:54 UTC

Thank, guys

Cleanup was done by Eray Aslan

GLSA vote: No

Comment 13 Mikle Kolyada (RETIRED) archtester

2015-03-07 12:12:53 UTC

GLSA vote: no.

Closing as [noglsa]