Bug 636040 (CVE-2017-7458, CVE-2017-7459) – <net-analyzer/ntopng-3.0: Multiple vulnerabilities (CVE-{7458,7459})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2017-10-31 14:22:38 UTC]

CVE-2017-7459 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7459):
  ntopng before 3.0 allows HTTP Response Splitting.

CVE-2017-7458 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7458):
  The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng
  before 3.0 allows remote attackers to cause a denial of service (NULL
  pointer dereference and application crash) via an empty field that should
  have contained a hostname or IP address.

[Comment 1 Christopher Díaz Riveros (RETIRED) 2017-10-31 14:23:31 UTC]

@Maintainer please let us know when tree is clean.

Thank you

[Comment 2 D'juan McDonald (domhnall) 2019-07-17 03:19:04 UTC]

Tree still contains version before 3.0

Keywords for net-analyzer/ntopng:
       |                               a   |       |  
       |                               m   |       |  
       |                               d x |       |  
       |                               6 8 |       |  
       |                               4 6 |   u   |  
       | a a   a     p r           s   | | |   n   |  
       | l m   r i   p i   h m s   p m f f | e u s | r
       | p d a m a p c s x p 6 3   a i b b | a s l | e
       | h 6 r 6 6 p 6 c 8 p 8 9 s r p s s | p e o | p
       | a 4 m 4 4 c 4 v 6 a k 0 h c s d d | i d t | o
-------+-----------------------------------+-------+-------
2.4    | o ~ o o o o o o ~ o o o o o o o o | 5 # 0 | gentoo
3.0-r3 | o ~ o o o o o o ~ o o o o o o o o | 6 o   | gentoo


Any update on reassignment of packages or cleanup?

[Comment 3 Larry the Git Cow 2019-12-28 12:08:32 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=befab011ab1f38e37a7b93238e9d0c7071ba725a

commit befab011ab1f38e37a7b93238e9d0c7071ba725a
Author:     Jeroen Roovers <[e-mail]>
AuthorDate: 2019-12-28 12:07:57 +0000
Commit:     Jeroen Roovers <[e-mail]>
CommitDate: 2019-12-28 12:08:29 +0000

    net-analyzer/ntopng: Old
    
    Package-Manager: Portage-2.3.84, Repoman-2.3.20
    Bug: https://bugs.gentoo.org/636040
    Signed-off-by: Jeroen Roovers <[e-mail]>

 net-analyzer/ntopng/Manifest                       |  2 -
 net-analyzer/ntopng/files/ntopng-2.4-cxx.patch     | 42 -----------
 .../ntopng/files/ntopng-2.4-dont-build-ndpi.patch  | 16 ----
 .../ntopng/files/ntopng-2.4-mysqltool.patch        | 17 -----
 net-analyzer/ntopng/files/ntopng-3.0-gentoo.patch  | 60 ---------------
 .../ntopng/files/ntopng-3.0-mysqltool.patch        | 17 -----
 .../ntopng/files/ntopng-3.0-pointer-cmp.patch      | 11 ---
 net-analyzer/ntopng/ntopng-2.4-r1.ebuild           | 86 ----------------------
 net-analyzer/ntopng/ntopng-3.0-r4.ebuild           | 75 -------------------
 9 files changed, 326 deletions(-)

[Comment 4 Thomas Deutschmann (RETIRED) 2020-03-16 22:50:54 UTC]

No ebuild was stable.

Repository is clean, all done!