Package: release.debian.org Severity: normal User: [email protected] Usertags: unblock
Please unblock package pam-pgsql The version I just uploaded to unstable contains a fix for CVE-2013-0191 [1], [2]. [1] https://security-tracker.debian.org/tracker/CVE-2013-0191 [2] http://bugs.debian.org/698241 A debdiff to the version currently in testing is attached. Best regards Jan unblock pam-pgsql/0.7.3.1-4 -- Jan Dittberner - Debian Developer GPG-key: 4096R/558FB8DD 2009-05-10 B2FF 1D95 CE8F 7A22 DF4C F09B A73E 0055 558F B8DD http://ddportfolio.debian.net/ - http://people.debian.org/~jandd/
diff -Nru pam-pgsql-0.7.3.1/debian/changelog pam-pgsql-0.7.3.1/debian/changelog --- pam-pgsql-0.7.3.1/debian/changelog 2012-04-06 21:04:49.000000000 +0200 +++ pam-pgsql-0.7.3.1/debian/changelog 2013-01-19 18:10:16.000000000 +0100 @@ -1,3 +1,12 @@ +pam-pgsql (0.7.3.1-4) unstable; urgency=low + + * Fix "CVE-2013-0191: NULL password query result permits login with + any password" by adding patch + debian/patches/fix-698241-null-passwort-result-permits-login.patch from + upstream bug tracker (Closes: #698241) + + -- Jan Dittberner <[email protected]> Sat, 19 Jan 2013 18:10:09 +0100 + pam-pgsql (0.7.3.1-3) unstable; urgency=low * apply hardened build flags (Closes: #656003), thanks for the patch diff -Nru pam-pgsql-0.7.3.1/debian/patches/fix-698241-null-passwort-result-permits-login.patch pam-pgsql-0.7.3.1/debian/patches/fix-698241-null-passwort-result-permits-login.patch --- pam-pgsql-0.7.3.1/debian/patches/fix-698241-null-passwort-result-permits-login.patch 1970-01-01 01:00:00.000000000 +0100 +++ pam-pgsql-0.7.3.1/debian/patches/fix-698241-null-passwort-result-permits-login.patch 2013-01-19 18:10:16.000000000 +0100 @@ -0,0 +1,16 @@ +Subject: Fix NULL password query result permits login with any password +Author: Lucas Clemente Vella +Origin: upstream, http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/ +Bug: https://sourceforge.net/p/pam-pgsql/bugs/13/ +Bug-Debian: http://bugs.debian.org/698241 +--- a/src/backend_pgsql.c ++++ b/src/backend_pgsql.c +@@ -258,7 +258,7 @@ + if(pg_execParam(conn, &res, options->query_auth, service, user, passwd, rhost) == PAM_SUCCESS) { + if(PQntuples(res) == 0) { + rc = PAM_USER_UNKNOWN; +- } else { ++ } else if (!PQgetisnull(res, 0, 0)) { + char *stored_pw = PQgetvalue(res, 0, 0); + if (!strcmp(stored_pw, (tmp = password_encrypt(options, user, passwd, stored_pw)))) rc = PAM_SUCCESS; + free (tmp); diff -Nru pam-pgsql-0.7.3.1/debian/patches/series pam-pgsql-0.7.3.1/debian/patches/series --- pam-pgsql-0.7.3.1/debian/patches/series 2012-04-06 21:04:49.000000000 +0200 +++ pam-pgsql-0.7.3.1/debian/patches/series 2013-01-19 18:10:16.000000000 +0100 @@ -1 +1,2 @@ ftbfs_441679.patch +fix-698241-null-passwort-result-permits-login.patch
signature.asc
Description: Digital signature
