September 2021 - devel - lists.freelock.com

ledgersmb_1.6.9+ds-2+deb11u3_amd64.changes ACCEPTED into proposed-updates->stable-new, proposed-updates
by Debian FTP Masters 02 Sep '21

02 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Aug 2021 15:19:14 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2+deb11u3 Distribution: bullseye-security Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Moritz Muehlenhoff <jmm(a)debian.org> Changes: ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results Checksums-Sha1: 8fd5dd9a18165c22620ac9db83f5987b17c2edf2 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc 508725785247f8dce475c381b97c2c1245ce8076 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz de527f1284cc5c0544c7be6ff97ec4a4d3135cec 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Checksums-Sha256: 583984855c0b04ee20e32013016deb671519a8e97e35eca091f1b9dbefa1d193 3265 ledgersmb_1.6.9+ds-2+deb11u3.dsc da1aa64aacfd8f6836ade3e28d1f0a67e478c80db82c98b7a2b1699639f19eaa 38332 ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz 72b46a983f0303ce007548539aed9c9dc76028d09f360d301ea4cab8c553fadd 15403 ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo Files: 8c6c6dde19d574ddb2444566b9fb1e71 3265 web optional ledgersmb_1.6.9+ds-2+deb11u3.dsc ae68c5012a260dc2499fe4059649f73d 38332 web optional ledgersmb_1.6.9+ds-2+deb11u3.debian.tar.xz a819f275b2f6b45dab9efeb946ca5cc4 15403 web optional ledgersmb_1.6.9+ds-2+deb11u3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEs3lQACgkQEMKTtsN8 TjaptQ/8C6B2lIStWLqp1pOdglwKGIkTLEY0tAbnVZ4k/DOPWy35t5l73e4f18+R oYyTHEv1R+p7KiWAky4tIZJgS5q1AaV8w+D0VMTa6mXAMyfMYybkvILu7m+BFs0u agc9AsV7FNq+wNQoOeViRRkoOYnSgHPPm9b3Qs1v8T1aIaxOZylpCOdCR9lwZycW IbYCT8bOBqt3iuObyklSBW2SPpLcDjiguFXkrkY5BC9QAK2Xce4g/h43jqH0yKws Tul1dZw03o8lC5EQMFyXd+tntB3kMcBZ5yj0jrFtknYSRxfY7fnUVzDSaR4lPw77 V5rhqBVeWaCw0lqbPV2jEwaWm2xzA78SIbOX7wdNsKcwDaoaDVL5BtsA0W0nXY+L 8SYVh8oJl8GcEQn9+5UduEbT3Ro82ErXMQgdeVXTTsiZOO1xsdVaEWYAgIrZqcR7 NQlRXNXEbPu3P523HJfg6uDEhUwUmnQV1PunES5E//0woc57Fb385XNL0bJtcLHL po2wFIlHMMgvr1ZmHc3NNQLNRnHWzhrQFRoM2Cs1OJbKYkDRqDRjjk4NzHRZhHnY VBOXzRsf3iJHAsIEzI6upSHLDGD7r/9L/6qxm2O+hnoN+tErG/DHdMba5RDZExuQ CJGGmbXKOrTiTO61g6U2zM8J+5juHNnnCrWFHfXLo8GfNwtAzN0= =zw21 -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Bug#992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731
by Salvatore Bonaccorso 01 Sep '21

01 Sep '21

Source: ledgersmb Version: 1.6.9+ds-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-1 Control: fixed -1 1.6.9+ds-1+deb10u2 Control: fixed -1 1.6.9+ds-2+deb11u2 Hi, The following vulnerabilities were published for ledgersmb. CVE-2021-3693[0]: | LedgerSMB does not check the origin of HTML fragments merged into the | browser's DOM. By sending a specially crafted URL to an authenticated | user, this flaw can be abused for remote code execution and | information disclosure. CVE-2021-3694[1]: | LedgerSMB does not sufficiently HTML-encode error messages sent to the | browser. By sending a specially crafted URL to an authenticated user, | this flaw can be abused for remote code execution and information | disclosure. CVE-2021-3731[2]: | LedgerSMB does not sufficiently guard against being wrapped by other | sites, making it vulnerable to 'clickjacking'. This allows an attacker | to trick a targetted user to execute unintended actions. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-3693 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3693 [1] https://security-tracker.debian.org/tracker/CVE-2021-3694 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3694 [2] https://security-tracker.debian.org/tracker/CVE-2021-3731 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3731 Please adjust the affected versions in the BTS as needed. Regards, Salvatore

2 2

ledgersmb_1.6.9+ds-2.1_source.changes ACCEPTED into unstable
by Debian FTP Masters 01 Sep '21

01 Sep '21

Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 01 Sep 2021 20:19:24 +0200 Source: ledgersmb Architecture: source Version: 1.6.9+ds-2.1 Distribution: unstable Urgency: medium Maintainer: LedgerSMB Core Team <devel(a)lists.ledgersmb.org> Changed-By: Mattia Rizzolo <mattia(a)debian.org> Closes: 992817 Changes: ledgersmb (1.6.9+ds-2.1) unstable; urgency=medium . * Non-maintainer upload. * Upload the last security fixes also to unstable. Closes: #992817 . ledgersmb (1.6.9+ds-2+deb11u3) bullseye-security; urgency=medium . * Fix a regression in the display of some search results . ledgersmb (1.6.9+ds-2+deb11u2) bullseye-security; urgency=medium . * Fix CVE-2021-3731, thanks to Erik Huelsmann . ledgersmb (1.6.9+ds-2+deb11u1) bullseye-security; urgency=medium . * Fix CVE-2021-3693 and CVE-2021-3694, thanks to Erik Huelsmann Checksums-Sha1: c5db18d0af429290e9258e4af13ba6fabd97a507 3241 ledgersmb_1.6.9+ds-2.1.dsc afaad1d50b746bed816647acc2e1bdc83af853e9 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz 11ff32e100ac28c47c1c13500d7cba52af5b8836 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Checksums-Sha256: 3af1270aee67be5af8298c51cfe4c2d475306e661d87ece2cd1c00d568186992 3241 ledgersmb_1.6.9+ds-2.1.dsc 91f28e5c0f6b6fca1c1555d7083ffbc8883b61b245c4db790e9c44fccf86aa67 38380 ledgersmb_1.6.9+ds-2.1.debian.tar.xz d6f9f0b64da3b8619cd1250eeda8b9ae557909c70cfd3534956080d292ccbc49 15237 ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Files: c4debdee8daeb6412314ab946e6e6722 3241 web optional ledgersmb_1.6.9+ds-2.1.dsc 90c9f6cab8c0e97ba8b536e5981c766c 38380 web optional ledgersmb_1.6.9+ds-2.1.debian.tar.xz 0aeaaf798b7b50314283466628240b51 15237 web optional ledgersmb_1.6.9+ds-2.1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAmEvxhsACgkQCBa54Yx2 K634og//XG6bAL2cOJwSBU5vuHxow106v1Fz3Gge5yVM5v+y+2hPdRhf/tfGhy8T yNZU9mifNzheOpo1/Y/STXLgTvO7Z5nmXVrWBa2qPO9EaJrH6cp/18XZldIv/kdP HnvPlxeBKPPkkx5Jf1qnm2BW95LZ9NIN8xKsscaeOAZRhLaYNwnrjfwxaoXTy6Cn pCAcUDk9u2/0MSVOIZoz8o7vv+5WwqHI41CRyCVxYAxuj6mE0KOIz+AT0KFpFDB8 VjBV6XmHYuV5d7ArxEVcz+bnl/ufifUmBDYGvkmN8MM0kpNX5McWaRrR49ZmNUaV 8G9+M8wOhZaxjVstHk31TDQV4DvrPE5q/9ZRB6U/lI5zub9k5C6ewncv8IV+7/jq uqxSusV7bhfKTTCCVkCV2aoFDEyb2yjQqddLuLaKc4JAohafq8CiNFXBJM7kG8bz bqGhHEj5rF6+BMVRJxfrvTOlTQvMZFJY+038Pckytr6nL7BWd0mc1agRai1PM2Hu NifvQ1ciYNLKKPYtQsph9Mu/QpJ6fGP4xBNxheyt8AAkw2mAQR7MKRrPbO7NW/mv S+D9foqDdskplZZb913Br7XpIzBJneCaYyLvAhR5+AXWTZ5AAj6/3q3BPjLo8wyu pF8hPNmciBC1IMuecs3rBa6xE8pmZV+7svKIMLvP051slLnp/YI= =uahl -----END PGP SIGNATURE----- Thank you for your contribution to Debian.

1 0

Processing of ledgersmb_1.6.9+ds-2.1_source.changes
by Debian FTP Masters 01 Sep '21

01 Sep '21

ledgersmb_1.6.9+ds-2.1_source.changes uploaded successfully to localhost along with the files: ledgersmb_1.6.9+ds-2.1.dsc ledgersmb_1.6.9+ds-2.1.debian.tar.xz ledgersmb_1.6.9+ds-2.1_amd64.buildinfo Greetings, Your Debian queue daemon (running on host usper.debian.org)

1 0

ledgersmb is marked for autoremoval from testing
by Debian testing autoremoval watch 31 Aug '21

31 Aug '21

ledgersmb 1.6.9+ds-2 is marked for autoremoval from testing on 2021-09-21 It is affected by these RC bugs: 992817: ledgersmb: CVE-2021-3693 CVE-2021-3694 CVE-2021-3731 https://bugs.debian.org/992817 This mail is generated by: https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/ma… Autoremoval data is generated by: https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gath…

1 0