Your message dated Sat, 20 Apr 2024 00:57:00 +0200
with message-id
<4cvkurezkcj5dmjdrqmdkitn7p3nhcb2tgrwvuhb22cc6zdo5d@crqscmncqft4>
and subject line Fwd: rpyc_6.0.0-1_source.changes ACCEPTED into unstable
has caused the Debian Bug report #1066879,
regarding rpyc: CVE-2024-27758
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1066879: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1066879
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rpyc
Version: 5.3.1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/tomerfiliba-org/rpyc/issues/551
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for rpyc.
CVE-2024-27758[0]:
| In RPyC before 6.0.0, when a server exposes a method that calls the
| attribute named __array__ for a client-provided netref (e.g.,
| np.array(client_netref)), a remote attacker can craft a class that
| results in remote code execution.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-27758
https://www.cve.org/CVERecord?id=CVE-2024-27758
[1] https://github.com/tomerfiliba-org/rpyc/issues/551
[2]
https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-h5cg-53g7-gqjw
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 6.0.0-1
----- Forwarded message from Debian FTP Masters
<[email protected]> -----
From: Debian FTP Masters <[email protected]>
To: Debian Python Team <[email protected]>, Timo Röhling
<[email protected]>
Subject: rpyc_6.0.0-1_source.changes ACCEPTED into unstable
Date: Wed, 17 Apr 2024 13:19:36 +0000
Thank you for your contribution to Debian.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 17 Apr 2024 15:06:23 +0200
Source: rpyc
Architecture: source
Version: 6.0.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Timo Röhling <[email protected]>
Changes:
rpyc (6.0.0-1) unstable; urgency=medium
.
* New upstream version 6.0.0
* Refresh patches (no functional changes)
* Reformat d/control
* Drop nose2 as test framework
* Bump Standards-Version to 4.7.0
Checksums-Sha1:
12263a447c880f9fa014dd1227e6eb043b389668 2793 rpyc_6.0.0-1.dsc
7bcb12854ae1af47b85d062079ad5b3ada4a9bd1 1273929 rpyc_6.0.0.orig.tar.gz
c49e84e59636c4216888b6754f4fe3bd8623eb0e 6828 rpyc_6.0.0-1.debian.tar.xz
Checksums-Sha256:
6ef7bb009b8d0cc89d80cd84a4ee7fcac53adc3fc84506d329ce89d65b87e0bc 2793
rpyc_6.0.0-1.dsc
d72b7dcb17e625bc02de142bb067657f988dbadba67840e7f205dd272a9ec535 1273929
rpyc_6.0.0.orig.tar.gz
ae7299a5712139e179d1e471d5ff16de4f0d112099e721dd113ac91f5e88ffd8 6828
rpyc_6.0.0-1.debian.tar.xz
Files:
9327fad0acca140aed1bb7ec53a36d41 2793 python optional rpyc_6.0.0-1.dsc
9c679f719042ba83c0695c2f362ef0a4 1273929 python optional rpyc_6.0.0.orig.tar.gz
d0157f615814ca800f3a007cd48f39e8 6828 python optional
rpyc_6.0.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEmwPruYMA35fCsSO/zIxr3RQD9MoFAmYfyzYUHHJvZWhsaW5n
QGRlYmlhbi5vcmcACgkQzIxr3RQD9Mrw5Q/+IcNf2hWY+NKYXH4QBtaIif/pZiV8
IcdFQfk+AVEPnXZLfGVwVgd12kf8oTRat5yRfTSL8oF/irfxURO55EkVP6PzkCrq
KToH8Ur8a/lbJzNCLgdGDK7IGLim6GcT0h0JllETlO79KzCbUHv2SxCp8o9Zu96C
zEnx3XFKLimEfLmmDckgsp0jL9Chw3IsAu7IcGlv5t/oy7mVX0rGmlxsRh69RfUU
7bNFciAqHMPOar/3TmqzHsc3rS08T1bb15imoC93Tif6ApRzL7TTxQ/sHf6ENCd+
gSpGSIp2zZF0qEo1tu/VJxhgSlawspgbXZOlNx7NYNzZd8h28ZPyYByKsAlB2wkQ
nKYXm/sSKokuebcoRxQA2t03z5Hvm1f1yYxiruafFVUL91lwSQ3XmXuO4K9gNe5u
C1kqjt9C9DarqYzrDewpxUXo//BVSEa1Z7Is53xJfhmv02eN6iVYLAy7/2ytnCPC
ATATZ9hykujb1amVICvQLdxDxv2fAH8Z1OtTGJda7hEfKFohTLaumI9Y+GmhTX/2
DxlDEXrpshyQRNwZDLcGCdB8RxG2fRkhIc9qg3EEp/LzgJDZoRG8ky5HWl71B8kn
fOnu3TEpTwD/6tPIeN+ZFQVevwaaBBBbwY23wHN9UBRi5OFmwG44JJf+g6g5P/nT
aqrt9KFWCaXXvNc=
=BQft
-----END PGP SIGNATURE-----
----- End forwarded message -----
--
⢀⣴⠾⠻⢶⣦⠀ ╭────────────────────────────────────────────────────╮
⣾⠁⢠⠒⠀⣿⡁ │ Timo Röhling │
⢿⡄⠘⠷⠚⠋⠀ │ 9B03 EBB9 8300 DF97 C2B1 23BF CC8C 6BDD 1403 F4CA │
⠈⠳⣄⠀⠀⠀⠀ ╰────────────────────────────────────────────────────╯
signature.asc
Description: PGP signature
--- End Message ---
