Your message dated Mon, 07 Oct 2019 13:04:26 +0000
with message-id <[email protected]>
and subject line Bug#941897: fixed in octavia 5.0.0~rc2-1
has caused the Debian Bug report #941897,
regarding CVE-2019-17134: agent doesn't check for client certificate
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
941897: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941897
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: octavia-agent
Version: 3.0.0-3
Severity: important
Tags: patch
The Octavia agent isn't enforcing 2 way certificates, meaning that anyone can
access the amphora-agent and manipulate it. I'm setting this bug as important,
as normally, in a reasonable setup, the load balancer management network
shouldn't be exposed to the public internet.
Patch is available here for all recent releases of Octavia:
https://review.opendev.org/#/q/I5619f5e40d7c9a2ee7741bf4664c0d2d08963992
Cheers,
Thomas Goirand (zigo)
--- End Message ---
--- Begin Message ---
Source: octavia
Source-Version: 5.0.0~rc2-1
We believe that the bug you reported is fixed in the latest version of
octavia, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated octavia package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 07 Oct 2019 14:46:10 +0200
Source: octavia
Architecture: source
Version: 5.0.0~rc2-1
Distribution: experimental
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 941897
Changes:
octavia (5.0.0~rc2-1) experimental; urgency=medium
.
* New upstream release fixing CVE-2019-17134 (Closes: #941897).
Checksums-Sha1:
80f33e6a69a01d297ae2e843a98945cec3f1b212 4216 octavia_5.0.0~rc2-1.dsc
ceadb1628d53731183bb776b5203fcaf03b69806 681612 octavia_5.0.0~rc2.orig.tar.xz
af28edf190f072c25649b6d2716ee66416e73ed8 8744 octavia_5.0.0~rc2-1.debian.tar.xz
d09dfc620c428ac5f04d6f62b983b5ba219b0f3e 19527
octavia_5.0.0~rc2-1_amd64.buildinfo
Checksums-Sha256:
6fc0caf2380554ebafb934f2b5c75814e2b5e8f78b52254ed6fc7db4ef981b0f 4216
octavia_5.0.0~rc2-1.dsc
e3945989dca6d972f3cbc89f46a48d2c812001a1f2016884e9a53f9165b92736 681612
octavia_5.0.0~rc2.orig.tar.xz
fcf4f302e1b914fe961c512ac8c3157cbbb7778dd65d5baf9c2937ae99b8db96 8744
octavia_5.0.0~rc2-1.debian.tar.xz
75a722c853e66b93f11174d8277d0725078de83ac045d5d9c2f0d9415bfd1d57 19527
octavia_5.0.0~rc2-1_amd64.buildinfo
Files:
578be46ba482512b76b47dbc09b3c694 4216 net optional octavia_5.0.0~rc2-1.dsc
f5bfc3cf23628ed037e0182b63f52181 681612 net optional
octavia_5.0.0~rc2.orig.tar.xz
e896440816c300c504d3d61f944599c7 8744 net optional
octavia_5.0.0~rc2-1.debian.tar.xz
4f0375f501c656eda7b2f189ab74449f 19527 net optional
octavia_5.0.0~rc2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAl2bNIwACgkQ1BatFaxr
Q/6RLw//RubMNuZNSLz74eZECE/gNnM1k2vSdGn2n2g0kKEryp7VRp910JuQieJK
j889g7WNztGvxiDcHW1ptvMwUA3FsZpj+p5aS9FR3xNRNkZgXdBuGlvUxNukeMLB
zpPofFGcMvTcqIttbUDBY/fmurOpvvm52bnHbRg7IETDm3c9Fc2S1ovgvUCeihoZ
s6iYjV42mtSpx8P6RmO8nwn9pMv+SRy8HHUubXjtzrUl7omskbp8/uqm1JMwk+jx
8AkF+3hWYd5eFvqtV4tkWIRw/0LATWa52i4rD5Ws6OlvnHSYjf81bEj28AuDH+Gz
ftXnOUf9HphhLqKaKZ067sPFy9eZhIWBmr5im0mpK6gDNge5PgHkCdsLptRSDRrD
xLe9OM1tf4CqXF5V3+u3t3/Lq6EOC69YZvwoZA18FNBgBRLWsNykCcey24aYy3D8
6Y1f7CkFJw5txhT/jPAt3nUuOwErGqFIgTLmii4Y8OwmAhzNrXbPWWajxQA6GBBN
5BVQCvFL9mhzjqwENkX5eAs7ZN+uUk8OEPHvhzJcbJrh9ujGE8KprOh34OJTWjfi
ZUPogO0K1LsoFDzdzPZUovXk13Rs3irYh35PXRUpNOPoK7W1oUnqLWxjs6FK5W9e
NHjdRMdOG/nmSRatfd2VmV1s+2jk2DEK0ahdlOnQ0N63fuULWU8=
=k8/i
-----END PGP SIGNATURE-----
--- End Message ---
