Monitoring Avril 2020

monitoring@federez.net

6 participants
65 discussions

5 Debian package update(s) for nonagon.federez.net

par root

apticron report [Thu, 23 Apr 2020 13:49:05 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u3 git-man 1:2.20.1-2+deb10u3 libssl1.1 1.1.1d-0+deb10u3 libssl-dev 1.1.1d-0+deb10u3 openssl 1.1.1d-0+deb10u3 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u3) buster-security; urgency=high * new upstream point release (see RelNotes/2.20.4.txt). * Addresses the security issue CVE-2020-11008. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Unlike the vulnerability fixed in 1:2.20.1-2+deb10u2, the credentials are not for a host of the attacker's choosing. Instead, they are for an unspecified host, based on how the configured credential helper handles an absent "host" parameter. The attack has been made impossible by refusing to work with underspecified credential patterns. Thanks to Carlo Arenas for reporting that Git was still vulnerable, Felix Wilhelm for providing the proof of concept demonstrating this issue, and Jeff King for promptly providing a corrected fix. Tested using the proof of concept at https://crbug.com/project-zero/2021. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 19 Apr 2020 17:19:12 -0700 git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.1d-0+deb10u3) buster-security; urgency=medium * CVE-2020-1967 (Segmentation fault in SSL_check_chain). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Mon, 20 Apr 2020 22:23:01 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

5 Debian package update(s) for nonagon.federez.net

par root

apticron report [Wed, 22 Apr 2020 13:49:09 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u3 git-man 1:2.20.1-2+deb10u3 libssl1.1 1.1.1d-0+deb10u3 libssl-dev 1.1.1d-0+deb10u3 openssl 1.1.1d-0+deb10u3 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u3) buster-security; urgency=high * new upstream point release (see RelNotes/2.20.4.txt). * Addresses the security issue CVE-2020-11008. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Unlike the vulnerability fixed in 1:2.20.1-2+deb10u2, the credentials are not for a host of the attacker's choosing. Instead, they are for an unspecified host, based on how the configured credential helper handles an absent "host" parameter. The attack has been made impossible by refusing to work with underspecified credential patterns. Thanks to Carlo Arenas for reporting that Git was still vulnerable, Felix Wilhelm for providing the proof of concept demonstrating this issue, and Jeff King for promptly providing a corrected fix. Tested using the proof of concept at https://crbug.com/project-zero/2021. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 19 Apr 2020 17:19:12 -0700 git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 --- Modifications pour openssl (libssl1.1 libssl-dev openssl) --- openssl (1.1.1d-0+deb10u3) buster-security; urgency=medium * CVE-2020-1967 (Segmentation fault in SSL_check_chain). -- Sebastian Andrzej Siewior <sebastian(a)breakpoint.cc> Mon, 20 Apr 2020 22:23:01 +0200 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

2 Debian package update(s) for nonagon.federez.net

par root

apticron report [Tue, 21 Apr 2020 13:49:05 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u3 git-man 1:2.20.1-2+deb10u3 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u3) buster-security; urgency=high * new upstream point release (see RelNotes/2.20.4.txt). * Addresses the security issue CVE-2020-11008. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Unlike the vulnerability fixed in 1:2.20.1-2+deb10u2, the credentials are not for a host of the attacker's choosing. Instead, they are for an unspecified host, based on how the configured credential helper handles an absent "host" parameter. The attack has been made impossible by refusing to work with underspecified credential patterns. Thanks to Carlo Arenas for reporting that Git was still vulnerable, Felix Wilhelm for providing the proof of concept demonstrating this issue, and Jeff King for promptly providing a corrected fix. Tested using the proof of concept at https://crbug.com/project-zero/2021. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 19 Apr 2020 17:19:12 -0700 git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

2 Debian package update(s) for nonagon.federez.net

par root

apticron report [Mon, 20 Apr 2020 13:49:05 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u2 git-man 1:2.20.1-2+deb10u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

Cron <root@dodecagon> /usr/bin/python3 /var/www/re2o/manage.py clean_notyetactive

par root＠federez.net

Deleting 0 users.

5 années

Cron <root@dodecagon> /usr/bin/python3 /var/local/re2o-services/dns/main.py

par root＠federez.net

5 années

2 Debian package update(s) for nonagon.federez.net

par root

apticron report [Sun, 19 Apr 2020 13:49:05 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u2 git-man 1:2.20.1-2+deb10u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

2 Debian package update(s) for nonagon.federez.net

par root

apticron report [Sat, 18 Apr 2020 13:49:06 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u2 git-man 1:2.20.1-2+deb10u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

Cron <root@dodecagon> /usr/bin/python3 /var/local/re2o-services/dns/main.py

par root＠federez.net

5 années

2 Debian package update(s) for nonagon.federez.net

par root

apticron report [Fri, 17 Apr 2020 13:49:05 +0200] ======================================================================== apticron has detected that some packages need upgrading on: nonagon.federez.net [ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ] The following packages are currently pending an upgrade: git 1:2.20.1-2+deb10u2 git-man 1:2.20.1-2+deb10u2 ======================================================================== Package Details: apt-listchanges : Lecture des fichiers de modifications (« changelog »)... apt-listchanges : journaux des modifications (« changelogs ») ------------------------------------------------------------- --- Modifications pour git (git git-man) --- git (1:2.20.1-2+deb10u2) buster-security; urgency=high [ Salvatore Bonaccorso ] * new upstream point release (see RelNotes/2.20.3.txt). * Addresses the security issue CVE-2020-5260. With a crafted URL that contains a newline, the credential helper machinery can be fooled to supply credential information for the wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. Thanks to Felix Wilhelm of Google Project Zero for finding this vulnerability and Jeff King for fixing it. -- Jonathan Nieder <jrnieder(a)gmail.com> Sun, 12 Apr 2020 00:24:43 -0700 ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as root on nonagon.federez.net -- apticron

5 années

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Monitoring Avril 2020