| Summary: | <net-irc/znc-1.7.3: crash on invalid encoding | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | sbraz |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1692768 | ||
| Whiteboard: | B3 [noglsa cve] | ||
| Package list: |
net-irc/znc-1.7.3
|
Runtime testing required: | --- |
Upstream told me a few days ago that 1.7.3 would be released one week after the RC. If they don't do it by tomorrow, I will add an ebuild for the RC. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a9cc051e15e39e75565eb2acf397f8eaad21cb0f commit a9cc051e15e39e75565eb2acf397f8eaad21cb0f Author: Louis Sautier <sbraz@gentoo.org> AuthorDate: 2019-03-31 22:55:10 +0000 Commit: Louis Sautier <sbraz@gentoo.org> CommitDate: 2019-03-31 22:56:34 +0000 net-irc/znc: bump to 1.7.3, fixes CVE-2019-9917 Bug: https://bugs.gentoo.org/681864 Package-Manager: Portage-2.3.62, Repoman-2.3.12 Signed-off-by: Louis Sautier <sbraz@gentoo.org> net-irc/znc/Manifest | 1 + net-irc/znc/znc-1.7.3.ebuild | 182 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 183 insertions(+) Arch teams, can you please stabilize version 1.7.3? x86 stable amd64 stable arm stable The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a627297e675af58ff38009ff59fa790275334868 commit a627297e675af58ff38009ff59fa790275334868 Author: Louis Sautier <sbraz@gentoo.org> AuthorDate: 2019-04-07 22:49:32 +0000 Commit: Louis Sautier <sbraz@gentoo.org> CommitDate: 2019-04-07 22:49:32 +0000 net-irc/znc: remove versions vulnerable to CVE-2019-9917 Bug: https://bugs.gentoo.org/681864 Package-Manager: Portage-2.3.62, Repoman-2.3.12 Signed-off-by: Louis Sautier <sbraz@gentoo.org> net-irc/znc/Manifest | 3 - net-irc/znc/znc-1.7.1.ebuild | 182 ------------------------------------------- net-irc/znc/znc-1.7.2.ebuild | 182 ------------------------------------------- 3 files changed, 367 deletions(-) Thanks, Louis! |
From ${URL} : Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925285 Upstream commit: https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.