[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#971062: marked as done (buster-pu: package plinth/19.1)

Your message dated Sat, 05 Dec 2020 11:02:00 +0000
with message-id <b70f86aac27195271a9b5212c7acc936da6ff100.camel@adam-barratt.org.uk>
and subject line Closing bugs for updates in 10.7 point release
has caused the Debian Bug report #971062,
regarding buster-pu: package plinth/19.1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
971062: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971062
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian.org@packages.debian.org
Usertags: pu
X-Debbugs-Cc: jvalleroy@mailbox.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

This update proposes to fix security tracker issue CVE-2020-25073,
where a remote attackers could obtain sensitive information from the
/server-status page of the Apache HTTP Server, because a connection
from the Tor onion service (or from PageKite) is considered a local
connection.

This issue also exists in stretch.

If the update is not approved, then users who enable Tor onion service
or Pagekite risk the apache server logs being publicly visible through
the onion address or kite URL.

To test, you would need to install freedombox package, click through
the initial setup, install Tor through the FreedomBox interface, and
then check if /server-status can be accessed through Tor browser using
the onion address displayed in the interface.

The change has already been applied in unstable, testing, and
buster-backports, and has been confirmed to solve the problem. The
change modifies the initial setup of apache web server so that
mod_status is disabled.

FreedomBox software does encourage use of backports, so I expect
nearly all users already have the fix. However, it is still good to
have it properly fixed in buster.

Please let know if you need any more information.

Thanks,
James

-----BEGIN PGP SIGNATURE-----

iQJKBAEBCgA0FiEEfWrbdQ+RCFWJSEvmd8DHXntlCAgFAl9v+x8WHGp2YWxsZXJv
eUBtYWlsYm94Lm9yZwAKCRB3wMdee2UICHLQD/oC5eSNW31WHHPQkAefjKzpHojN
qFqb73JtgGaXquHo5REeNEQvrNO2b0AMOdYNBJPIEkPQu42ffznLggbleP1soapw
K/R7UjESVkXmNNDdzgAbjUy9YpdGLM0nNCG72wY2cuQse9nLIRZa3gPQ8+4MxizR
zInnTz7uAkcyd6J2RRF2h6GF0qvAfFWc0gniDtBdJQc2oNcHQsf3Nl81e91THrSm
Law5SrDeu/1wjH+OWZcPnyBrq0abA+V6kDFYjprzM9dnjRnln5ONOUvOdfMeJ8aa
BSWXfKcMZPyOtKZAFQ4lAQTIZivoZWS1TZjI7fLMKydT4Vda3fvwLYtULxDXorp1
Q5uxN4VwV4rF1I/OhaJeAV702emMLEdZ104OwegG2+ND6JqUlgYHPViA2xMIHzI4
DanaeIqHjd8oDYTClq5rgHGZgqbc7bMr0rbGxB8iSrJAqP0AXFMc8RiZVVZXLsEf
aqawiwU02Whq4VxWPLP4rOB1m84LB1YYZ4/fkqjjWcvfWyfK+hASGZYp8k7npP/S
Lia+g5Ibx3/b9PXdEg0Opn92SJcVbp9JDirx4PdRPd9/80qirBuDOkA3oHrog/X/
sO9IKRXfWxzuN4PDEv4Fn6tpZeqEbTlY6mBvWaxEdNhhizOOrUuvzIuPbz143aaw
tA9xT532YZqFuymT8Q==
=Nhun
-----END PGP SIGNATURE-----

diff -Nru plinth-19.1/actions/apache plinth-19.1+deb10u1/actions/apache
--- plinth-19.1/actions/apache	2019-02-14 06:01:19.000000000 -0500
+++ plinth-19.1+deb10u1/actions/apache	2020-09-21 21:40:22.000000000 -0400
@@ -122,6 +122,9 @@
         webserver.enable('proxy_fcgi', kind='module')
         webserver.enable('rewrite', kind='module')
 
+        # Disable /server-status page to avoid leaking private info.
+        webserver.disable('status', kind='module')
+
         # switch to mod_ssl from mod_gnutls
         webserver.disable('gnutls', kind='module')
         webserver.enable('ssl', kind='module')
diff -Nru plinth-19.1/debian/changelog plinth-19.1+deb10u1/debian/changelog
--- plinth-19.1/debian/changelog	2019-02-14 06:01:19.000000000 -0500
+++ plinth-19.1+deb10u1/debian/changelog	2020-09-21 21:40:22.000000000 -0400
@@ -1,3 +1,9 @@
+plinth (19.1+deb10u1) buster; urgency=medium
+
+  * apache: Disable mod_status (CVE-2020-25073)
+
+ -- James Valleroy <jvalleroy@mailbox.org>  Mon, 21 Sep 2020 21:40:22 -0400
+
 plinth (19.1) unstable; urgency=medium
 
   [ James Valleroy ]

--- End Message ---
--- Begin Message --- 
Package: release.debian.org
Version: 10.7

Hi,

Each of the updates referenced by these bugs was included in this
morning's buster 10.7 point release.

Regards,

Adam

--- End Message ---
Reply to: