From ${URL} : A vulnerability in the Smack XMPP library was reported where the security of the TLS connection is not always enforced. By stripping the "starttls" feature from the server response with a man-in-the-middle tool, an attacker can force the client to authenticate in clear text even if the "SecurityMode.required" TLS setting has been set. References: http://seclists.org/oss-sec/2016/q4/716 https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22 Upstream bug: https://issues.igniterealtime.org/browse/SMACK-739 Upstream patches: https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820b https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
@ Maintainer(s): Please bump to >=dev-java/smack-4.1.9.
@maintainer(s), please bump the package. Multiple vulnerabilities present so candidate for PMASK.
please bump
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e80934f925f9640a1c43020531ff1d06fe5e67d4 commit e80934f925f9640a1c43020531ff1d06fe5e67d4 Author: Aaron Bauman <bman@gentoo.org> AuthorDate: 2019-08-14 20:10:11 +0000 Commit: Aaron Bauman <bman@gentoo.org> CommitDate: 2019-08-14 20:10:11 +0000 profiles/package.mask: mask dev-java/smack * Package has longstanding vulnerabilities * Unmaintained in Gentoo Bug: https://bugs.gentoo.org/509354 Bug: https://bugs.gentoo.org/519216 Bug: https://bugs.gentoo.org/603440 Signed-off-by: Aaron Bauman <bman@gentoo.org> profiles/package.mask | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b284fe06667eddb6283c94328bccdde0dc622446 commit b284fe06667eddb6283c94328bccdde0dc622446 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2019-09-14 15:36:42 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2019-09-14 15:37:35 +0000 dev-java/smack: Remove last-rited pkg Bug: https://bugs.gentoo.org/509354 Bug: https://bugs.gentoo.org/519216 Bug: https://bugs.gentoo.org/603440 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-java/smack/Manifest | 2 -- dev-java/smack/metadata.xml | 8 ------ dev-java/smack/smack-2.2.1.ebuild | 60 --------------------------------------- dev-java/smack/smack-3.2.1.ebuild | 30 -------------------- profiles/package.mask | 6 ---- 5 files changed, 106 deletions(-)
buh bye
