Hi Amul,
Am Thu, Jun 16, 2022 at 12:16:09PM +0000 schrieb Shah, Amul:
> Thanks for explaining that! I was very worried that the reproducible
> builds would fail the version.
I guess you were worried since Salsa-CI was informing you about this.
It was actually no change to the situation before ... except that we
recently switched on Salsa-CI and so you became aware of the issue which
existed all the time before.
> Did I do the right things to properly close
> the two bugs logged against fis-gtm?
Yes.
> We have another release coming out by the end of the month. I
> should have that one uploaded sooner than later.
Please reconsider the "add any minor version bump leads to a new binary
file name" strategy. This means that fis-gtm always needs to pass the
Debian new queue which always means that there is a hardly predictable
delay when the package will reach the distribution.
> thanks,
Thanks to you as well
Andreas.
> Amul
>
> From: Andreas Tille <andr...@fam-tille.de>
> Date: Thursday, 06 16, 2022 at 05:23 AM
> To: Shah, Amul <amul.s...@fisglobal.com>
> Cc: Neil Williams <codeh...@debian.org>, 1009...@bugs.debian.org
> <1009...@bugs.debian.org>
> Subject: Re: Bug#1009900: fis-gtm: Multiple CVEs in fis-gtm
> Hi Amul,
>
> Am Wed, Jun 15, 2022 at 01:50:32PM +0000 schrieb Shah, Amul:
> > Hi Andreas and Neil,
> > I pushed my changes (for real this time)
>
> Thanks for pushing. I confirm I have uploaded the package to NEW (due
> to new binary package name.
>
> > and the CI/CD pipeline reported a failure for reproducibility
> > (https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsalsa.debian.org%2Fmed-team%2Ffis-gtm%2F-%2Fjobs%2F2874740&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=khmOXK3qZrSw%2BLbzR6AcHQN%2FvmGdAH5KAyB01DoD1fI%3D&reserved=0).
> > I’m not sure what to do with this failure because GT.M generates output
> > files in the build which modifies time stamps and what not. I’m reading the
> > reprotest man page. Do either of you have any advice? For example, things I
> > should not do.
>
> Reproducible builds can be a bit complex. I admit I *personally* tend
> to ignore those issues and wait until reproducibility team might develop
> a patch since they have way more experience in this field. Usually its
> a consequence of the upstream build system, for instance like adding the
> time stamp of the build. This should rather be replaced by the time
> stamp of the debian/changelog for instance.
>
> Since reproducibility is not a critical issue for a package (but for
> sure nice to have!) and if you have no real idea what to do its probably
> fine as it is now.
>
> Kind regards
>
> Andreas.
>
> > Thanks,
> > Amul
> >
> > From: Shah, Amul <amul.s...@fisglobal.com>
> > Date: Thursday, 06 09, 2022 at 04:53 PM
> > To: Neil Williams <codeh...@debian.org>, Andreas Tille <andr...@an3as.eu>
> > Cc: 1009...@bugs.debian.org <1009...@bugs.debian.org>
> > Subject: Re: Bug#1009900: fis-gtm: Multiple CVEs in fis-gtm
> > Hi Andreas and Neil,
> > Thanks for you input and patience. I pushed FIS GT.M V7.0-002 which
> > includes the fixes for the CVEs listed in Bug#1009900. That was easier than
> > back porting the fixes.
> >
> > Thanks,
> > Amul
> >
> > On 04/21/22, 02:51 AM, "Neil Williams" <codeh...@debian.org> wrote:
> > On Wed, 20 Apr 2022 19:55:02 +0000
> > "Shah, Amul" <amul.s...@fisglobal.com<mailto:amul.s...@fisglobal.com>>
> > wrote:
> >
> > > Hi Andreas,
> > > In FIS's opinion, the CVE references are not actionable.
> >
> > (The usual term would be "exploitable".) I understand that, the CVEs
> > arose from fuzz testing, so represent weaknesses, not active attacks.
> >
> > > One must
> > > have host access and the ability to modify application source files.
> > > Those users are typically database/systems administrators or a MUMPS
> > > application developer. We expect that only privileged users have
> > > direct access to the host with the application gating access to
> > > external users. By itself, GT.M does not confer any extra privileges.
> > >
> > > How long we have to address these CVEs?
> >
> > I did not set an RC severity, I chose 'important' on the basis of the
> > description in the upstream issue. There is no specific time limit for
> > these CVEs - the vulnerabilities are already public, not embargoed
> > until a set date. The highest severities are reserved for remotely
> > exploitable CVEs.
> >
> > For unstable, the best fix would seem to be a new upstream release.
> > There are multiple CVEs, some CVEs reference multiple commits.
> >
> > > If immediate, I can
> > > back-patch the specific fixes that address the CVEs. I say back patch
> > > because V6.3-014 was the last V6 version with a V6 block format
> > > database. The current V7 GT.M versions do not have an upgrade path to
> > > the V7 block format. We do not want to release a GT.M version to
> > > debmed without such an upgrade feature. If there is time, then we are
> > > working a V7 version with the V6 to V7 block upgrade capability and
> > > would like to release that.
> >
> > Seems sensible.
> >
> >
> > >
> > > Thanks,
> > > Amul
> > >
> > > -----Original Message-----
> > > From: Andreas Tille <andr...@an3as.eu<mailto:andr...@an3as.eu>>
> > > Sent: Wednesday, April 20, 2022 3:00 PM
> > > To: Neil Williams <codeh...@debian.org<mailto:codeh...@debian.org>>;
> > > 1009...@bugs.debian.org<mailto:1009...@bugs.debian.org>;
> > > Shah, Amul <amul.s...@fisglobal.com<mailto:amul.s...@fisglobal.com>>
> > > Subject: Re: Bug#1009900:
> > > fis-gtm: Multiple CVEs in fis-gtm
> > >
> > > Hi Amul,
> > >
> > > I guess a new upstream version will fix this. Are you able to prepare
> > > the latest version?
> > >
> > > Kind regards
> > >
> > > Andreas.
> > >
> > > Am Wed, Apr 20, 2022 at 11:13:31AM +0100 schrieb Neil Williams:
> > > > Source: fis-gtm
> > > > Version: 6.3-014-3
> > > > Severity: important
> > > > Tags: security
> > > > X-Debbugs-Cc: codeh...@debian.org<mailto:codeh...@debian.org>, Debian
> > > > Security Team
> > > > <t...@security.debian.org<mailto:t...@security.debian.org>>
> > > >
> > > > Hi,
> > > >
> > > > The following vulnerabilities were published for fis-gtm.
> > > >
> > > > CVE-2021-44492[0]:
> > > > | An issue was discovered in YottaDB through r1.32 and V7.0-000 and
> > > > FIS | GT.M through V7.0-000. Using crafted input, attackers can
> > > > cause a type | to be incorrectly initialized in the function f_incr
> > > > in | sr_port/f_incr.c and cause a crash due to a NULL pointer
> > > > dereference.
> > > >
> > > >
> > > > CVE-2021-44493[1]:
> > > > | An issue was discovered in YottaDB through r1.32 and V7.0-000 and
> > > > FIS | GT.M through V7.0-000. Using crafted input, an attacker can
> > > > cause a | call to $Extract to force an signed integer holding the
> > > > size of a | buffer to take on a large negative number, which is
> > > > then used as the | length of a memcpy call that occurs on the
> > > > stack, causing a buffer | overflow.
> > > >
> > > >
> > > > CVE-2021-44494[2]:
> > > > | An issue was discovered in YottaDB through r1.32 and V7.0-000 and
> > > > FIS | GT.M through V7.0-000. Using crafted input, an attacker can
> > > > cause | calls to ZRead to crash due to a NULL pointer dereference.
> > > >
> > > >
> > > > CVE-2021-44495[3]:
> > > > | An issue was discovered in YottaDB through r1.32 and V7.0-000 and
> > > > FIS | GT.M through V7.0-000. Using crafted input, an attacker can
> > > > cause a | NULL pointer dereference after calls to ZPrint.
> > > >
> > > >
> > > > CVE-2021-44496[4]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > control the | size variable and buffer that is passed to a call to
> > > > memcpy. An | attacker can use this to overwrite key data structures
> > > > and gain | control of the flow of execution.
> > > >
> > > >
> > > > CVE-2021-44497[5]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, can cause the bounds
> > > > of a for | loop to be miscalculated, which leads to a use after
> > > > free condition a | pointer is pushed into previously free memory by
> > > > the loop.
> > > >
> > > >
> > > > CVE-2021-44498[6]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, attackers can cause
> > > > a type to | be incorrectly initialized in the function f_incr in
> > > > sr_port/f_incr.c | and cause a crash due to a NULL pointer
> > > > dereference.
> > > >
> > > >
> > > > CVE-2021-44499[7]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > cause a call | to $Extract to force an signed integer holding the
> > > > size of a buffer to | take on a large negative number, which is
> > > > then used as the length of a | memcpy call that occurs on the
> > > > stack, causing a buffer overflow.
> > > >
> > > >
> > > > CVE-2021-44500[8]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). A lack of input validation in calls to
> > > > eb_div in | sr_port/eb_muldiv.c allows attackers to crash the
> > > > application by | performing a divide by zero.
> > > >
> > > >
> > > > CVE-2021-44501[9]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > cause calls | to ZRead to crash due to a NULL pointer dereference.
> > > >
> > > >
> > > > CVE-2021-44502[10]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > control the | size of a memset that occurs in calls to util_format
> > > > in | sr_unix/util_output.c.
> > > >
> > > >
> > > > CVE-2021-44503[11]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > cause a call | to va_arg on an empty variadic parameter list, most
> > > > likely causing a | memory segmentation fault.
> > > >
> > > >
> > > > CVE-2021-44504[12]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > cause a size | variable, stored as an signed int, to equal an
> > > > extremely large value, | which is interpreted as a negative value
> > > > during a check. This value is | then used in a memcpy call on the
> > > > stack, causing a memory segmentation | fault.
> > > >
> > > >
> > > > CVE-2021-44505[13]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, an attacker can
> > > > cause a NULL | pointer dereference after calls to ZPrint.
> > > >
> > > >
> > > > CVE-2021-44506[14]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). A lack of input validation in calls to
> > > > do_verify | in sr_unix/do_verify.c allows attackers to attempt to
> > > > jump to a NULL | pointer by corrupting a function pointer.
> > > >
> > > >
> > > > CVE-2021-44507[15]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). A lack of parameter validation in calls
> > > > to memcpy | in str_tok in sr_unix/ztimeoutroutines.c allows
> > > > attackers to attempt | to read from a NULL pointer.
> > > >
> > > >
> > > > CVE-2021-44508[16]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). A lack of NULL checks in calls to
> > > > ious_open in | sr_unix/ious_open.c allows attackers to crash the
> > > > application by | dereferencing a NULL pointer.
> > > >
> > > >
> > > > CVE-2021-44509[17]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, attackers can cause
> > > > an | integer underflow of the size of calls to memset in op_fnj3 in
> > > > | sr_port/op_fnj3.c in order to cause a segmentation fault and
> > > > crash the | application.
> > > >
> > > >
> > > > CVE-2021-44510[18]:
> > > > | An issue was discovered in FIS GT.M through V7.0-000 (related to
> > > > the | YottaDB code base). Using crafted input, attackers can cause a
> > > > | calculation of the size of calls to memset in op_fnj3 in
> > > > | sr_port/op_fnj3.c to result in an extremely large value in order
> > > > to | cause a segmentation fault and crash the application.
> > > >
> > > >
> > > > If you fix the vulnerabilities please also make sure to include the
> > > > CVE (Common Vulnerabilities & Exposures) ids in your changelog
> > > > entry.
> > > >
> > > > For further information see:
> > > >
> > > > [0]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44492&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=GVOvP%2FE%2FCSBfn7uiBXJu48Oa6LjaNi5AMtmcdEg8cw8%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44492&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=bzDGwfAl0Ma%2BAr84ABmC4jDAOo7Qa2YWAk1rVg8Jf4c%3D&reserved=0
> > > > [1]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44493&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=LV8ggOtH6Gy6EO0chPZYnHInk%2FVC%2BXrMb5H2D2Uw8Hg%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44493&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=1yX2TZbdPI9m8BsHifj89y9gLyDVWz04cGiTltc0rDQ%3D&reserved=0
> > > > [2]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44494&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=8HOh52r49LKtEi%2FHSldZ4gDpA%2BEvBfydwGlgPchal0c%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44494&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=FAuBCz%2F%2B77Itan0OXetAvh%2BUwDyHWHI5sCnlEqTvma0%3D&reserved=0
> > > > [3]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44495&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=xdMktLdJkCUNGbeC7BYMAyYovAATryezPwDC5XOvTw8%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44495&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=ukZUMFZx5QQK9tes4Fypz8As60E4n3N52GzCAg0EnCY%3D&reserved=0
> > > > [4]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44496&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=aAZVxFu4gPOrzVLZJDIkAaAiNNBP8BWfsFmWT2wdq5U%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44496&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=SkTWS3R1oFU1gZmDcMcZpkEhQSt%2BUKwCniiR84JzjGY%3D&reserved=0
> > > > [5]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44497&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=ssbOVLhiw1zqQO3LFMkyr%2B2ggxiYbJtN0xLkXmGldPQ%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44497&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=29N70E%2BnUzOB9dQAWOLH0LEONhAruX7nUCARv5Cz5CA%3D&reserved=0
> > > > [6]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44498&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=%2BPDe0gsZ4zgYAd%2BObjQQyk%2B2z0KW40SmmLDDrqf9o7w%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44498&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=gGJy5ypfv4GeZz2uLXgAprHakDkCCHaav4A93rlGxeY%3D&reserved=0
> > > > [7]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44499&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=hMXk%2B2Gwk6MIOFwicB36CF%2F2RjqL%2BA8O44tF78Dyux0%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44499&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=S3xNRIA3XIdTRsz75joxFtKR3VpeYrcLgSHYsViRu%2Bw%3D&reserved=0
> > > > [8]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44500&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=q0qjxlQuVmMymhLEhWzrTJuIlCqRszRaIc%2Bez3QhCtI%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44500&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=LLvB1Pdwu5AKj8bG5rdEFyD0%2BFWK5G4SspEhEaFc48c%3D&reserved=0
> > > > [9]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44501&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=ZlEpiVomA0Bjd47rSoAKkknmcRwaQm7kkeDClcdz6kc%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44501&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=763tlMtgRGWkSpk2KBHYR0tCsfK5dDivtdbMDRTizrM%3D&reserved=0
> > > > [10]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44502&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=Nl1qUuXcDin5ZyBIoh0tqSZaMKiqVUMuvX26iSXpcYg%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44502&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=g%2F2o%2F2Ndd0iRiAep67VAM3UAnfeRHPrOFL9x7%2FezjPY%3D&reserved=0
> > > > [11]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44503&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=7xUOtnpGKyh8aF6PAKhhwwPYQDslnKTdXFPEw%2Fx%2BoUA%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44503&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=RvmA8Z2EJKOy%2FISbcRnZ8GKzzEaenndAb5vaYPV%2BVPk%3D&reserved=0
> > > > [12]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44504&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=4xKyKVXExFgmjVl4k5r4P632%2Bzivkui1aVI%2Fkl2V6To%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44504&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=zyjZ2g8AD36WOrVtzJoCbZbmfp7hP5GRFWuIhGLDoFI%3D&reserved=0
> > > > [13]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44505&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=kLMefEsQ1h0h%2F%2BzjJX%2FjKw3A3FNcdAl7%2F7bMgePRM5M%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44505&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=GuBrLBpI%2FvIPaghghwWfzKYc0Csip5e9WZra9gBDgR4%3D&reserved=0
> > > > [14]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44506&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=uOvyPrlmtY2nsRIawKgnEpmLPFUVvUES6Qd76F%2FyeCU%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44506&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=MUxBaMPVKTO21x7BmTkAV3a7qa1nkTLZL6EvSPK7Rbw%3D&reserved=0
> > > > [15]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44507&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=rq1p28hk9v0GUP9630ZNC%2Bc3eBYBHJUnYIN1yk%2FlPTk%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44507&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=TmaD3ylk%2FZuwpKOPWXdMyPgFCbynvcfqWYu%2FjeaS%2BlY%3D&reserved=0
> > > > [16]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44508&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=kxzZKX9GnvGtJdkak9HvsFx82pkhN1PP88L8DOXTJbQ%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44508&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=gjmAFQs1s0GgF1Z%2BCtwVspqLoJx2dUen66gMzZDq8Lg%3D&reserved=0
> > > > [17]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44509&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=WXYAe6MKD0RMKS55AQ0%2FftV%2B4Gt6W2nmVYIQZyvzH94%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44509&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=Hg3hXgTmNEH8hZk40F1nNbSyA5c%2ByM8T0py4PBhaHIE%3D&reserved=0
> > > > [18]
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsecurity-tracker.debian.org%2Ftracker%2FCVE-2021-44510&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=sCWhaOQM0JbAq8cnWY45DzJx9KrNJnYPTofmvSkBiVE%3D&reserved=0
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2021-44510&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=BwWpJrPO8TyJbV01gjx19mERdfBbeRL6vXq5GSsjjYw%3D&reserved=0
> > > >
> > > > Please adjust the affected versions in the BTS as needed.
> > > >
> > > >
> > > > -- System Information:
> > > > Debian Release: bookworm/sid
> > > > APT prefers unstable
> > > > APT policy: (500, 'unstable'), (1, 'experimental')
> > > > Architecture: amd64 (x86_64)
> > > > Foreign Architectures: i386
> > > >
> > > > Kernel: Linux 5.16.0-6-amd64 (SMP w/16 CPU threads; PREEMPT)
> > > > Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
> > > > LANGUAGE=en_GB:en Shell: /bin/sh linked to /usr/bin/dash
> > > > Init: systemd (via /run/systemd/system)
> > > > LSM: AppArmor: enabled
> > > >
> > > > _______________________________________________
> > > > Debian-med-packaging mailing list
> > > > debian-med-packag...@alioth-lists.debian.net<mailto:debian-med-packag...@alioth-lists.debian.net>
> > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Falioth-lists.debian.net%2Fcgi-bin%2Fmailman%2Flistinfo%2Fdebian-med-packaging&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=YdDAFBFNpsI8%2Bn8oDu8PPpEw0%2B%2F0wCaJryWDIzpZTNs%3D&reserved=0
> > > >
> > >
> > > --
> > > https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Ffam-tille.de%2F&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=q3Hj7qleDbx9e6sCyHuFoDQoXDcIkHSMQngBPKkTplc%3D&reserved=0
> > > The information contained in this message is proprietary and/or
> > > confidential. If you are not the intended recipient, please: (i)
> > > delete the message and all copies; (ii) do not disclose, distribute
> > > or use the message in any manner; and (iii) notify the sender
> > > immediately. In addition, please be aware that any message addressed
> > > to our domain is subject to archiving and review by persons other
> > > than the intended recipient. Thank you.
> >
> >
> > --
> > Neil Williams
> > =============
> > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinux.codehelp.co.uk%2F&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=3BUi7XU2itf1lQFeUsSfI%2FTKnk0zHSW%2FZOL%2B%2F0JmxOA%3D&reserved=0
> >
> > The information contained in this message is proprietary and/or
> > confidential. If you are not the intended recipient, please: (i) delete the
> > message and all copies; (ii) do not disclose, distribute or use the message
> > in any manner; and (iii) notify the sender immediately. In addition, please
> > be aware that any message addressed to our domain is subject to archiving
> > and review by persons other than the intended recipient. Thank you.
>
> --
> https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Ffam-tille.de%2F&data=05%7C01%7Camul.shah%40fisglobal.com%7C6b002e9869384d6cadd308da4f79e086%7Ce3ff91d834c84b15a0b418910a6ac575%7C0%7C0%7C637909682140179197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=q3Hj7qleDbx9e6sCyHuFoDQoXDcIkHSMQngBPKkTplc%3D&reserved=0
> The information contained in this message is proprietary and/or confidential.
> If you are not the intended recipient, please: (i) delete the message and all
> copies; (ii) do not disclose, distribute or use the message in any manner;
> and (iii) notify the sender immediately. In addition, please be aware that
> any message addressed to our domain is subject to archiving and review by
> persons other than the intended recipient. Thank you.
--
http://fam-tille.de
