Bug 47475

Summary: libsoup2.4: Multiple issues (4.3)
Product: UCS Reporter: Quality Assurance <qa>
Component: Security updatesAssignee: Quality Assurance <qa>
Status: CLOSED FIXED QA Contact: Philipp Hahn <hahn>
Severity: normal    
Priority: P3    
Version: UCS 4.3   
Target Milestone: UCS 4.3-1-errata   
Hardware: All   
OS: Linux   
What kind of report is it?: Security Issue What type of bug is this?: ---
Who will be affected by this bug?: --- How will those affected feel about the bug?: ---
User Pain: Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: Bug group (optional):
Max CVSS v3 score: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Description Quality Assurance univentionstaff 2018-08-08 07:41:00 CEST 
New Debian libsoup2.4 2.56.0-2+deb9u2 fixes:
This update addresses the following issue(s):
* 
* The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname. (CVE-2018-12910)

2.56.0-2+deb9u2 (Tue, 03 Jul 2018 18:04:10 +0100) * Fix out of bounds access in the cookie jar (CVE-2018-12910) - debian/patches/0001-cookie-jar-bail-if-hostname-is-an-empty-string.patch, debian/patches/0002-Add-soup_cookie_jar_get_cookies-with-empty-hostname-.patch: Cherry-pick two patches from upstream: the actual fix and a test for it.
* CVE-2018-12910 libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)
Comment 1 Quality Assurance univentionstaff 2018-08-08 19:08:25 CEST 
--- mirror/ftp/4.3/unmaintained/4.3-0/source/libsoup2.4_2.56.0-2+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-1/source/libsoup2.4_2.56.0-2+deb9u2.dsc
@@ -1,3 +1,10 @@
+2.56.0-2+deb9u2 [Tue, 03 Jul 2018 18:04:10 +0100] Iain Lane <laney@debian.org>:
+
+  * Fix out of bounds access in the cookie jar (CVE-2018-12910)
+    - debian/patches/0001-cookie-jar-bail-if-hostname-is-an-empty-string.patch,
+      debian/patches/0002-Add-soup_cookie_jar_get_cookies-with-empty-hostname-.patch:
+      Cherry-pick two patches from upstream: the actual fix and a test for it.
+
 2.56.0-2+deb9u1 [Wed, 09 Aug 2017 16:31:37 +0200] Salvatore Bonaccorso <carnil@debian.org>:
 
   * Non-maintainer upload by the Security Team.

<http://10.200.17.11/4.3-1/#2440322378206886878>
Comment 2 Philipp Hahn univentionstaff 2018-08-09 09:17:09 CEST 
OK: patches
OK: piuparts
OK: yaml
OK: errata-announce libsoup2.4.yaml

[4.3-1] c6bb2cbdaa Bug #47475: libsoup2.4 2.56.0-2+deb9u2
 doc/errata/staging/libsoup2.4.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
Comment 3 Arvid Requate univentionstaff 2018-08-15 13:14:32 CEST 
<http://errata.software-univention.de/ucs/4.3/186.html>