[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#983479: marked as done (glibc: CVE-2021-27645: double-free in nscd)

Your message dated Sun, 21 Mar 2021 00:03:31 +0000
with message-id <E1lNlZ5-000Cl7-Je@fasolo.debian.org>
and subject line Bug#983479: fixed in glibc 2.31-10
has caused the Debian Bug report #983479,
regarding glibc: CVE-2021-27645: double-free in nscd
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
983479: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983479
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: glibc
Version: 2.31-9
Severity: important
Tags: security upstream
Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=27462
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>,fw@debian.org
Control: found -1 2.28-10
Control: found -1 2.28-1

Hi,

The following vulnerability was published for glibc.

CVE-2021-27645[0]:
| The nameserver caching daemon (nscd) in the GNU C Library (aka glibc
| or libc6) 2.29 through 2.33, when processing a request for netgroup
| lookup, may crash due to a double-free, potentially resulting in
| degraded service or Denial of Service on the local system. This is
| related to netgroupcache.c.

Upstream this has been introduced in 2.29 but AFAICS we have the
problematic change since 2.28-1 in Debian itself due to [2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-27645
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27645
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=27462
[2] https://salsa.debian.org/glibc-team/glibc/-/commit/aea56157b456d4d9bef337d0149e952a41a7d919

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: glibc
Source-Version: 2.31-10
Done: Aurelien Jarno <aurel32@debian.org>

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 983479@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 21 Mar 2021 00:38:37 +0100
Source: glibc
Architecture: source
Version: 2.31-10
Distribution: unstable
Urgency: medium
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Closes: 981198 983457 983479 984533
Changes:
 glibc (2.31-10) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * debian/patches/hurd-i386/git-tiocflush.diff: Cope with
     BSD 4.1-ish ioctl(..., TIOCFLUSH, NULL).
   * debian/debhelper.in/libc-udeb.install.hurd-i386: Add missing
     libmachuser/libhurduser.
   * debian/testsuite-xfail-debian.mk: Update tests.
 .
   [ Aurelien Jarno ]
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix a possible assertion failure in iconv when converting
       from ISO-2022-JP-3 to UTF-8 (CVE-2021-3326).  Closes: #981198.
     - Fix a possible double-free in nscd when processing a request for netgroup
       lookup (CVE-2021-27645).  Closes: #983479.
   * debian/debhelper.in/libc.preinst: fallback to text mode in case 1) debconf
     is about to use the dialog frontend with whiptail or frontend and 2) the
     corresponding executable is unusable.  Closes: #984533.
   * debian/rules.d/debhelper.mk: correctly strip libpthread.so for bi/triarch
     builds.  Closes: #983457.
Checksums-Sha1:
 c2d6c808acf5d3589abf1248745806db91a828f5 8315 glibc_2.31-10.dsc
 269753eb6881c30a2c45c5b42da0cc029bd9a24b 906616 glibc_2.31-10.debian.tar.xz
 6c278605bc85861f66c0349b47493d0b3e6ca6ae 8583 glibc_2.31-10_source.buildinfo
Checksums-Sha256:
 76e69265d37a253bee7e81e842fc984479df68ec939cb8c464f7f5c71ba7a08c 8315 glibc_2.31-10.dsc
 f72c53818b5f7d3ab9e0ab8743a6e1fd4506c32dc0e54bc99601aa13f603bcb3 906616 glibc_2.31-10.debian.tar.xz
 3409be76a1deb825e2644b657acbfaf2fbed1f7a253ffd16208694cb1f01b2ba 8583 glibc_2.31-10_source.buildinfo
Files:
 b45860af69d98b10372a1aba78fee7da 8315 libs required glibc_2.31-10.dsc
 e688926956b203ddc615f122b520afd2 906616 libs required glibc_2.31-10.debian.tar.xz
 99f9a84b3027839f8f0c3c2d48b8fce9 8583 libs required glibc_2.31-10_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUryGlb40+QrX1Ay4E4jA+JnoM2sFAmBWiM4ACgkQE4jA+Jno
M2tkiw//WOsI3Sp2HjFuiG37g3+tAsBJFDDALrHSTUQ7YMGcnkAa4101W5DwSA1P
xw139p3K8ThH6MSG/gVEnKXZlFUDuYYzyfzHVnhlMDXYWODBZkMYqQyKPrW78ook
k5+Ct2DD1UNCUfkdT18cl2Fgg62iZTqUVRQ5qBf6FzATzfg5kf+hhZ4sa1X8Tsxl
6LW7FDYhH6667EVKyI4ESepsAJoz7yG5jOcP8amsNe7poxBjerd9mMny60ys4NdD
QMRnrsDDv/DLRyYj0oo84zg69asXrsDZf8DKQPVYT5ESr+xIQ3UlfaiBIIB+Qrgr
kh+i8N0YFkuiWHKRaQV9HRFH7eA/srsqZuckaPmfyIN6bkQV7bCrtuQ6tWU48r95
jjZfHlJDaFs7NqgvjfxEXeObpBOXckMWl0+S8BJRJrLyhNuMMJ2enhwqg5csIR58
LcXEMeJPvNvgHVv15t7R/WVCAW9qdxBRoUv5IHlhU29dnEFGBfj4GTdLhlbbornT
HnLxSCf3dkGn7+HBBp8eHZvk6QarSKqyljiasrIPWywdFezmIPOfZb7UUkKQ0Ftn
C2EXSpf9hJRJ6GN0xzxMKpN+RXRSHO+6uSsbnA2PzGDAqy+dQbBV/O6TPhXSD50W
qmCvxovSGiTCRqKxVkWeNE8wZa6uY7g0T1cj5BpzPs+RthnRyNw=
=INaF
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: