Your message dated Sat, 01 Nov 2025 18:20:44 +0000
with message-id <[email protected]>
and subject line Bug#1118280: fixed in luksmeta 10-1
has caused the Debian Bug report #1118280,
regarding luksmeta: CVE-2025-11568
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1118280: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118280
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: luksmeta
Version: 9-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for luksmeta.
CVE-2025-11568[0]:
| A data corruption vulnerability has been identified in the luksmeta
| utility when used with the LUKS1 disk encryption format. An attacker
| with the necessary permissions can exploit this flaw by writing a
| large amount of metadata to an encrypted device. The utility fails
| to correctly validate the available space, causing the metadata to
| overwrite and corrupt the user's encrypted data. This action leads
| to a permanent loss of the stored information. Devices using the
| LUKS formats other than LUKS1 are not affected by this issue.
There is not really much information about that issue. The only
reference is the Red Hat Bugzilla one at [1], but nothing other than
that. Upstream does not contain recent commits.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-11568
https://www.cve.org/CVERecord?id=CVE-2025-11568
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2404244
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: luksmeta
Source-Version: 10-1
Done: Christoph Biedl <[email protected]>
We believe that the bug you reported is fixed in the latest version of
luksmeta, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christoph Biedl <[email protected]> (supplier of updated luksmeta
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 01 Nov 2025 15:16:59 +0100
Source: luksmeta
Architecture: source
Version: 10-1
Distribution: unstable
Urgency: high
Maintainer: Christoph Biedl <[email protected]>
Changed-By: Christoph Biedl <[email protected]>
Closes: 1118280
Changes:
luksmeta (10-1) unstable; urgency=high
.
* New upstream version 10. Closes: #1118280 [CVE-2025-11568]
Checksums-Sha1:
8a2fddbe9983acd2c78cc4abe88ad7592299a1ed 2021 luksmeta_10-1.dsc
189b849f94c1fc9aa9d74667c78b0c4af0ba0770 28221 luksmeta_10.orig.tar.gz
9a3f35a2b56886e8b6cddf60b8e53365b6489dee 3736 luksmeta_10-1.debian.tar.xz
7c0882e83fb92223e5eed915dc96c1f3a91c25b0 7625 luksmeta_10-1_powerpc.buildinfo
Checksums-Sha256:
8815e1235c0d4f03b718f717496ef3152549f6ae6cdc2f1d6917192c9b7b628c 2021
luksmeta_10-1.dsc
9479726b1bdcaf01c9df4b945df5857fdcebe2e8d81f8a6c641674a906890c17 28221
luksmeta_10.orig.tar.gz
fb642be66251bd5d2c5a9942c5d0e9113a77b3f21ad4d034d78f77d303542b75 3736
luksmeta_10-1.debian.tar.xz
de98882b2ec485c21d0e91f040204c3c21cdeabd747dee7f6943f3d3e694cc5f 7625
luksmeta_10-1_powerpc.buildinfo
Files:
44417fa9447e0fc13005f0568c655215 2021 net optional luksmeta_10-1.dsc
03670e4f0711caa66a8c5763156ae132 28221 net optional luksmeta_10.orig.tar.gz
da45ce733c88a0a1615789b9d2c4255d 3736 net optional luksmeta_10-1.debian.tar.xz
65bf7c52e400db0f359fdd07362287d2 7625 net optional
luksmeta_10-1_powerpc.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmkGSnYACgkQxCxY61kU
kv1FPw//Yci3Dwjd5utaiaTXQmJ8QGl00hhEhnoRLTcR8LdM3YgHPzLKILpxnqI5
4OUBDmfFUD1RKYIryMLuNSCQrwCwldbaSCxh1g2bgc2b74zxpwZ4RcK/s1qR5sn2
bHxg8OGZT69+8K8E/c3T1dRSAYpUnHCRPEzC2jxkOE4RheprusJlNjIk7prl8ra1
Kzia4WxZ8WtdWpJ4BLeV7Fx78qL1rWIAZhduyf8Hv6veC/tjuTUS1Uuby3Pd/G0b
tV4+8qX+kYTW8pvZHPjnLxG6PYouE4SmHzsVuVi6KKMPE+kIrr9dqpQo8dLjuz3I
HA8Y5AcFaPrBn4lDgS2I8nkSIfu4GpC4PZo4qmE4NovJW3Vd/jRO8vCQkUm/DQ23
90sNh760rA9dPNkudoQmNFahmuvvJ2ks7fnzN5oywJHDcvbdWHwOqH2TB98zWc+P
+N0nMlN7WRagH8kcdP3mYqXQp9QJ5E3JfN9Ldz2LvYWA2f7Pjn83TTHodwKivMU5
o5AMga4sv+KMrpfM3Sa/kvux7uKXglQBst6a5bFEUT1XzF1yiQgdOfNymQIibtz+
1nB4tzS77mJMuCojO43wWILnXw7S3M9OzitzSO18g5yMUdCkSfCnLzFPhH+g9Upb
DAldW/SC7oTZz2ILRuOz+kxkbKr0BqkUSaJHzKN1/MOBf4mhmrE=
=MdDW
-----END PGP SIGNATURE-----
pgpBB7FPLciWE.pgp
Description: PGP signature
--- End Message ---
