it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Moritz Muehlenhoff <jmm AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5472-1] cjose security update
- Date: Tue, 8 Aug 2023 19:19:32 +0000
- Authentication-results: mail.piratenpartei.de; dkim=none; spf=none (mail.piratenpartei.de: domain of "bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org" has no SPF policy when checking 82.195.75.100) smtp.mailfrom="bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org"; dmarc=none
- List-archive: https://lists.debian.org/msgid-search/ZNKVRICc1erX+3zk AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=noGagP62Hx5Ol86ONUKXHrqrS0czdhecYVXs5O9bMeY=; b=CD F0A4fIg9j6qPtaVHkh1jisdpmNgkwwI9hXzD6vEH/Q/N0bps6WLr8d5XJew7ofsAjwKiTqjJAPeRF DEFAGu9PxcrFgftWLxvktBdl3mNqJoIv5DzIEabQL9paUU8n0NfGm6JIuP7uRx1QTecfCbWjeWbWC qtwErEeThfi1xqG/q3ij9e2wtlvzpu75ijw5GN6ppBsi9zGSoPipqrl/zrdVdpoJgsWcmJYl0+wA6 1cMhJROPMQqQG1SE+owydJMmkhXxVWZHPLhyNzkbtkKM8HuJYNbmRH+HaEjpMC+KW2nqe+iLR9FBA q4he25Fa45y+6GncoIYFPUwJbG/n6bWQ==;
- Old-return-path: <jmm AT seger.debian.org>
- Priority: urgent
- Resent-date: Tue, 8 Aug 2023 19:19:57 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <iu50aj3ihuG.A.U_.dVp0kB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5472-1 security AT debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
August 08, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : cjose
CVE ID : CVE-2023-37464
Debian Bug : 1041423
It was discovered that an incorrect implementation of AES GCM decryption
in cjose, a C library implementing the JOSE standard may allow an attacker
to provide a truncated Authentication Tag and modify the JWE object.
For the oldstable distribution (bullseye), this problem has been fixed
in version 0.6.1+dfsg1-1+deb11u1.
For the stable distribution (bookworm), this problem has been fixed in
version 0.6.2.1-1+deb12u1.
We recommend that you upgrade your cjose packages.
For the detailed security status of cjose please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cjose
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmTSlQcACgkQEMKTtsN8
TjZCgw//ajZImjIQAbYdWOQPQCn4rrHu3FOcoyuHUluEZhiziZxEcsO+kSCDJBqa
e6LDuKC5B3uvA4UQcfXPbi2QqdQGbMBE8chmHqqOL6ia86VJhUBU7USu+PVpVn1k
Qf8SWtHGC/7OijpbJA0KQT99GKLrQI3z1maKjxT9t9OiYd7v1leuXIHd0G/fBeR+
aSimNdY5vTfdXJMreUopCxiyyiKIXjBzC1rct3/yxCqfPpw0WUmsXq4CcY0F6v0U
zpFOiHPHDwUwPfshPs6mNZRlDqnANLYunKn9Cs9c2ZYwCgNqs6CU8NYEXAuqLOCl
xCxMF1wq96nKl1RVHFP3xdp3LP0CL8Gnvm6sQ9lnzThrEnm+1bNo3Zfq4CpykSo2
FAwV56miW2G8cyBXPLAQRW9237AZw7mGovxckEgF6gmV/Q2Hn4DXBDC231cCsjhY
JFWB45zAKIqP3Y+ZntugJF8Tjipb3LxuJcxCu2GCaAL35tp/+T+8k6QFmcSGDz0J
QpWZArFmnejyjddctAUkWJQD1CPZbp+EUxZZbgG0QeSdiLQqqNPXXxtCVpWbnzyX
+0JkKD0f/3+bRv0vokbWgtN5EAvJR+2au29Jb/xVwE4dgXdS/yVqLndaBkbHxsJ2
tPoleid7Qij4yFvXDjrTcjH7LN61UF1Q5prZNBKnFA3uUtNPbJ4=
=3VDm
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5472-1] cjose security update, Moritz Muehlenhoff, 08.08.2023
Archiv bereitgestellt durch MHonArc 2.6.24.