Source: openconnect Version: 8.02-1 Severity: grave Tags: security upstream Justification: user security hole Control: found -1 7.08-1
Hi, The following vulnerability was published for openconnect. CVE-2019-16239[0]: | process_http_response in OpenConnect before 8.05 has a Buffer Overflow | when a malicious server uses HTTP chunked encoding with crafted chunk | sizes. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2019-16239 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16239 [1] https://github.com/openconnect/openconnect/commit/875f0a65ab73f4fb581ca870fd3a901bd278f8e8 [2] http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html Regards, Salvatore
