Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 694314 - Buffer overflow in net-misc/pump
Summary: Buffer overflow in net-misc/pump
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Deadline: 2019-10-14
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-09-13 19:56 UTC by ltspro2
Modified: 2019-11-07 19:06 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description ltspro2 2019-09-13 19:56:56 UTC
There is a security vulnerability in net-misc/pump. It has been reported to Debian previously, they patched it in Debian 8 and removed the package from Debian 9.10 and 10.1 because of lack of maintenance.
https://security-tracker.debian.org/tracker/source-package/pump
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933674
https://www.debian.org/lts/security/2019/dla-1908
Comment 1 Agostino Sarubbo gentoo-dev 2019-09-14 13:33:46 UTC
Thanks for the report. I think we will treeclean it.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935332
Comment 2 Larry the Git Cow gentoo-dev 2019-09-14 13:48:40 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6b2ff6538c99875e713cdc6a5c641a9f53339859

commit 6b2ff6538c99875e713cdc6a5c641a9f53339859
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2019-09-14 13:44:14 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2019-09-14 13:48:35 +0000

    package.mask: Last rite net-misc/pump
    
    Bug: https://bugs.gentoo.org/694314
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 profiles/package.mask | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
Comment 3 Larry the Git Cow gentoo-dev 2019-10-14 20:07:10 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=48cf9f4466de549fd83cdf4040499bdeeb9242f6

commit 48cf9f4466de549fd83cdf4040499bdeeb9242f6
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2019-10-14 20:04:00 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2019-10-14 20:06:58 +0000

    net-misc/pump: Remove last-rited pkg
    
    Bug: https://bugs.gentoo.org/694314
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 net-misc/pump/Manifest              |  2 --
 net-misc/pump/metadata.xml          |  8 ------
 net-misc/pump/pump-0.8.24-r4.ebuild | 56 -------------------------------------
 profiles/package.mask               |  7 -----
 4 files changed, 73 deletions(-)
Comment 4 Thomas Deutschmann gentoo-dev Security 2019-10-26 18:01:51 UTC
Package was stable, we need to create a removal GLSA.
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2019-11-07 19:06:45 UTC
This issue was resolved and addressed in
 GLSA 201911-02 at https://security.gentoo.org/glsa/201911-02
by GLSA coordinator Aaron Bauman (b-man).