Your message dated Sat, 21 Jun 2014 18:32:08 +0000
with message-id <[email protected]>
and subject line Bug#746758: fixed in ldns 1.6.13-1+deb7u1
has caused the Debian Bug report #746758,
regarding ldnsutils: CVE-2014-3209: ldns-keygen creates private key world
readable
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
746758: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746758
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ldnsutils
Severity: important
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
The ldns-keygen tool creates a keypair, one of which should be kept
private. The tool apparently use default access rights for all files,
leading to the private key being created world readable.
- Jonas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQF8BAEBCgBmBQJTZMh7XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ3NjQ4ODQwMTIyRTJDNTBFQzUxRDQwRTI0
RUMxQjcyMjM3NEY5QkQ2AAoJEE7BtyI3T5vW+QgIAJdT1+2r/0fOHcL1DXn/JkF+
EccUvBXSNjhnxmWJdmYGwosKzZt6aL4S1vxZPaBvhnINTAy0uDmjt3Ct75nft9GC
1hwYJl3IZRbmmHFadK5a1xKizD/NTz/ndB+fIbR+QjvYdmsUItWKL9226alzrheA
bCDI3RnFFeDFjjGVrxkCXEG59G5ZlWZrD95KhXVcxhM5B6qMZbgM/qU2Pis2eH18
3cz40jPTDAsw238Bvom86d9jX9n/NUJ2xS1GBAxdSt083VuwTivr0cVkE/lbvuA7
FLJiq/gfJXGOE42xXvtmTvsHAsZY8olF4vUSzmfkDODW78bpvzbRIgavxLRGUO8=
=PU+Q
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
Source: ldns
Source-Version: 1.6.13-1+deb7u1
We believe that the bug you reported is fixed in the latest version of
ldns, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ondřej Surý <[email protected]> (supplier of updated ldns package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 13 Jun 2014 11:06:52 +0200
Source: ldns
Binary: libldns1 libldns1-dbg libldns-dev ldnsutils python-ldns
Architecture: source amd64
Version: 1.6.13-1+deb7u1
Distribution: wheezy
Urgency: medium
Maintainer: Ondřej Surý <[email protected]>
Changed-By: Ondřej Surý <[email protected]>
Description:
ldnsutils - ldns library for DNS programming
libldns-dev - ldns library for DNS programming
libldns1 - ldns library for DNS programming
libldns1-dbg - ldns library for DNS programming (debug symbols)
python-ldns - Python bindings for the ldns library for DNS programming
Closes: 746758
Changes:
ldns (1.6.13-1+deb7u1) wheezy; urgency=medium
.
* [CVE-2014-3209]: fix ldns-keygen writing private DNSKEYs with default
umask (Closes: #746758)
Checksums-Sha1:
cba655bcb503a51419b78a7d7ac4f3006a85a38e 2156 ldns_1.6.13-1+deb7u1.dsc
900e87ec46d0c2031074a80c884a217329ffa8e2 13660
ldns_1.6.13-1+deb7u1.debian.tar.gz
d80ce04c37e2cb67a1b65772a94a5ca19a84ee8b 167112
libldns1_1.6.13-1+deb7u1_amd64.deb
a7d53ebc25433d7b3093722b26379a0211bab299 349548
libldns1-dbg_1.6.13-1+deb7u1_amd64.deb
d069b6c28b8e116fb65a20c7bdfe568370851966 599868
libldns-dev_1.6.13-1+deb7u1_amd64.deb
e4d7b4f9ebcae3e3b87235ff2dee1f6432f2b7d0 173264
ldnsutils_1.6.13-1+deb7u1_amd64.deb
2adc30dab7212ca70724d83d9abe30de2fabd569 425526
python-ldns_1.6.13-1+deb7u1_amd64.deb
Checksums-Sha256:
c338ba37cdb1087d88b6e49882e17d501d9a714790a4ad98d6cea0523665a9a9 2156
ldns_1.6.13-1+deb7u1.dsc
8f9c93455a806e5ee1f2f87dfe0bad4d27188f0b141a6c90f91a8acac2cca489 13660
ldns_1.6.13-1+deb7u1.debian.tar.gz
f23c1f858b8693338068ee436156db95c0e31f7424dd64b20e6acb6cdffdb139 167112
libldns1_1.6.13-1+deb7u1_amd64.deb
a55dff9594a0c3396996265be5c98894d118baf46bd739ed6f3cf351396532c3 349548
libldns1-dbg_1.6.13-1+deb7u1_amd64.deb
726e07ab8230a3a14026a3381e968da3de748f05085594ce67c48ba1b3f09aec 599868
libldns-dev_1.6.13-1+deb7u1_amd64.deb
a388a272acc252c9c66ab86fa94995d569a332068768c5a6648a8fb9a80475e8 173264
ldnsutils_1.6.13-1+deb7u1_amd64.deb
47b7f915cf2bb23f47f4e747115fb7d50c96611f285acbf2720e61a4f0c25692 425526
python-ldns_1.6.13-1+deb7u1_amd64.deb
Files:
1bcdfbdcdc4de0bc6f52f54688819c78 2156 net extra ldns_1.6.13-1+deb7u1.dsc
46f73a07d589e717c31ee4ef48f00e81 13660 net extra
ldns_1.6.13-1+deb7u1.debian.tar.gz
451ef1cd8f58b2dc8b3ad51af7951418 167112 libs extra
libldns1_1.6.13-1+deb7u1_amd64.deb
ce59db4474d05d1e87d06763ec7d0d93 349548 debug extra
libldns1-dbg_1.6.13-1+deb7u1_amd64.deb
ee6351949ec7dc5718c867522480df31 599868 libdevel extra
libldns-dev_1.6.13-1+deb7u1_amd64.deb
3cbe8b4ce565699494f567e1370da898 173264 net extra
ldnsutils_1.6.13-1+deb7u1_amd64.deb
45f748a79a4ccfc160b73ccb9009b738 425526 python extra
python-ldns_1.6.13-1+deb7u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJTotc9AAoJEAyZtw70/LsHJj8P/1sJdojuGB/7OYHdACv9l63/
kNJuq6vucDqbO05ogXUzE6w9HzaQHmZCBAuOf/DUa+x9Dlx26VhUuRCUoHXAJLHg
M51nKh+uh4MJ81EYYju8OuEg+g8YbsbILJoZYU56vz7y+r9cpRmS6FeBGmlWtgAK
DmduQLiYF+AklDCywFI6q9MZOm2pKcpqMFmzJKbYm+N3aRRsI08SaGJRFHF9gQhW
nK9WqWzqdqsCQ1cCdtdvwmRQ0XWgKzojbzdU5jjS05+DGQ26zQ8XYm9Kbth94uzn
aqmuz1JW8xWqAqlbsttYadorcjLkzsDqsN6j1273Nu+3dgUhEcsk4ab8Jrh+ClaO
HVUHeltRGtYDWa0b+GoqDR+6U8B1oFjt3tTAwA0/s+m5brFzHQRac5vqAPik+E/0
/le4LmJ9glnUuxR2WESzZIaQd8iYc9P526E9W1ipKCe7RlaaAXHqTDufTZ8qtAMo
8zPekgOJ5xayfOP9Hn1wRiu3y1A5z8i6he5/rv+8A6SM7clVrURw7xk/8/MWM64+
JpT0or2L/pH9eQanZj1cBgVINdGMFbjZpg2cYiymiTrXS4wLE4rHlVOpRDRUIhvS
2lyEYcnVVlDadOx73cmw/SNyMhSTsA2dH1nHszGxis8JtWalTnJkT/Gc4ltOyIwN
XSFDmLG2ABeWR5EqhbbV
=PTMm
-----END PGP SIGNATURE-----
--- End Message ---
