Bug 47522 - xml-security-c: Multiple issues (4.2)
xml-security-c: Multiple issues (4.2)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.2
All Linux
: P5 normal (vote)
: UCS 4.2-4-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-08-09 10:17 CEST by Quality Assurance
Modified: 2018-08-15 16:19 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2018-08-09 10:17:32 CEST
New Debian xml-security-c 1.7.2-3+deb8u1 fixes:
This update addresses the following issue(s):
* 
TEMP-0905332-CB57BF is resolved

1.7.2-3+deb8u1 (Sun, 05 Aug 2018 20:01:03 +0200) * [109db8e] New patch: Default KeyInfo resolver doesn't check for empty element content. The Apache Santuario XML Security for C++ library contained a number of code paths at risk of dereferencing null pointers when processing various kinds of malformed KeyInfo hints typically found in signed or encrypted XML. The usual effect is a crash, and in the case of the Shibboleth SP software, a crash in the shibd daemon. Upstream bug: https://issues.apache.org/jira/projects/SANTUARIO/issues/SANTUARIO-491 CVE: not assigned yet Thanks to Scott Cantor * [4dafdb4] Replace Russ in Uploaders
Comment 1 Quality Assurance univentionstaff 2018-08-09 18:44:15 CEST
--- mirror/ftp/4.2/unmaintained/4.2-0/source/xml-security-c_1.7.2-3.dsc
+++ apt/ucs_4.2-0-errata4.2-4/source/xml-security-c_1.7.2-3+deb8u1.dsc
@@ -1,3 +1,18 @@
+1.7.2-3+deb8u1 [Sun, 05 Aug 2018 20:01:03 +0200] Ferenc Wágner <wferi@debian.org>:
+
+  * [109db8e] New patch: Default KeyInfo resolver doesn't check for empty
+    element content.
+    The Apache Santuario XML Security for C++ library contained a
+    number of code paths at risk of dereferencing null pointers when
+    processing various kinds of malformed KeyInfo hints typically found
+    in signed or encrypted XML. The usual effect is a crash, and in the
+    case of the Shibboleth SP software, a crash in the shibd daemon.
+    Upstream bug:
+      https://issues.apache.org/jira/projects/SANTUARIO/issues/SANTUARIO-491
+    CVE: not assigned yet
+    Thanks to Scott Cantor (Closes: #905332)
+  * [4dafdb4] Replace Russ in Uploaders
+
 1.7.2-3 [Mon, 07 Apr 2014 17:10:56 -0700] Russ Allbery <rra@debian.org>:
 
   * Avoid use of PATH_MAX where possible by using getcwd to allocate the

<http://10.200.17.11/4.2-4/#2268654937856334235>
Comment 2 Philipp Hahn univentionstaff 2018-08-10 10:21:29 CEST
OK: patch
OK: piuparts
OK: yaml
OK: errata-announce

[4.2-4] 9e02b0275e Bug #47522: xml-security-c 1.7.2-3+deb8u1
 doc/errata/staging/xml-security-c.yaml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

[4.2-4] 3f61d8666c Bug #47522: xml-security-c 1.7.2-3+deb8u1
 doc/errata/staging/xml-security-c.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
Comment 3 Arvid Requate univentionstaff 2018-08-15 16:19:50 CEST
<http://errata.software-univention.de/ucs/4.2/489.html>