Hi Thorsten

I have not seen an email about that this package has been accepted by the
FTP archieve, neither can I find the fixed version in the archives. Can you
please check what went wrong?

In addition I think something have went wrong in the security tracker
database because the two CVEs are listed as unfixed. Can you check that as
well?

> ola@tigereye:~/git/security-tracker$ bin/lts-cve-triage.py
> --skip-dla-needed --exclude undetermined
> Updating ~/.cache/debian_security_tracker.json from
> https://security-tracker.debian.org/tracker/data/json ...
> Updating /home/ola/.cache/security-support-ended.deb7 from
> https://salsa.debian.org/debian/debian-security-support/raw/master/security-support-ended.deb7
> ...
> Updating /home/ola/.cache/security-support-limited from
> https://salsa.debian.org/debian/debian-security-support/raw/master/security-support-limited
> ...
> Other issues to triage for wheezy (not yet triaged for jessie):
> * mosquitto
> https://security-tracker.debian.org/tracker/source-package/mosquitto
>   - CVE-2017-7651
> https://security-tracker.debian.org/tracker/CVE-2017-7651
>   - CVE-2017-7652
> https://security-tracker.debian.org/tracker/CVE-2017-7652



Thanks in advance

// Ola

On 31 March 2018 at 20:24, Thorsten Alteholz <deb...@alteholz.de> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Package        : mosquitto
> Version        : 0.15-2+deb7u3
> CVE ID         : CVE-2017-7651 CVE-2017-7652
>
>
> CVE-2017-7651
>      A crafted CONNECT packet from an unauthenticated client could
>      result in extraordinary memory consumption.
>
> CVE-2017-7652
>      In case all sockets/file descriptors are exhausted, a SIGHUP
>      signal to reload the configuration could result in default
>      config values (especially bad security settings)
>
>
> For Debian 7 "Wheezy", these problems have been fixed in version
> 0.15-2+deb7u3.
>
> We recommend that you upgrade your mosquitto packages.
>
> Further information about Debian LTS security advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://wiki.debian.org/LTS
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
>
> iQJ8BAEBCgBmBQJav9JTXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
> ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2MjAxRkJGRkRCQkRFMDc4MjJFQUJCOTY5
> NkZDQUMwRDM4N0I1ODQ3AAoJEJb8rA04e1hHXJIQALUMNe9NaCPBKQaTJE3sKo2v
> 1CIAzcoTwZJzUr/x8zM8Bnompi7kh5j2V4G4GjJyJ31LZheDxRH/k35t1Ba6PAtl
> TkTRgO/PVoJKYHIfyUinNvqzsXFpAzld08w5sVlA7zzxmnm6Ppwwdpk6g2hSIoSG
> 1Z5STvO6eJLiK8u6hXgkqyaY/4eKlfbTe+Fkd35LzoqJPEHNyLHDBsNQk8/VO1xn
> 3aNjsU7kc07n/qofFKcWZrlSt6L8Q+ucmHeinwOKT8r/H7/DxXr3yqQqXJ/C+/n+
> cwjX5KTng5eEy27WmHv41oamaty4qmlM1uf/yX48th8FQdV6AV7uRK2Y+AKsat04
> VaZdTBk4AZKn8u7A9jypqoILhU97SJyVO1jvO5Cqe2lP4OrT9J86MWDs496ZtQEb
> 4Qi6M76LueYoo7iggv67ATQKwXpARS3J8fMEo+0xBC+Oa76m016eotPkUdRpmmMC
> 08BSzI2tuQG3i4gbbz96u5bhCyGauFcjnWsTHD97MgCGz9LfBywkrk4eippp/sIF
> rJMsYNJMfiJfB2L7f2dZ+heinTjM1x4KfKf+LceZiNcHy6SNycUFD0YLs9ZxvK90
> /o5Diq8tjlCl6lxr4A3swvl3xxlpC+M9XuPgfWIsnWxKIQ6J+1Qmv4f6RVfNHAJc
> cys3l3XIVUAWhqkkuvaF
> =qQYi
> -----END PGP SIGNATURE-----
>
>


-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
/  o...@inguza.com                    Folkebogatan 26            \
|  o...@debian.org                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /
 ---------------------------------------------------------------

Reply via email to