Your message dated Tue, 08 Dec 2015 11:19:28 +0000
with message-id <e1a6giq-0003jh...@franck.debian.org>
and subject line Bug#802671: fixed in bouncycastle 1.44+dfsg-2+deb6u1
has caused the Debian Bug report #802671,
regarding CVE-2015-7940: bouncycastle: ECC private keys can be recovered via 
invalid curve attack
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
802671: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802671
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: bouncycastle
Version: 1.44+dfsg-2
Severity: serious
Tags: security
Control: fixed -1 1.51-1

Hello,

bouncycastle 1.49 in stable/testing/unstable (and 1.44 in wheezy/squeeze)
is vulnerable to an invalid curve attack as described here:
https://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html

This is fixed in version 1.51 (in experimental).

The upstream patches that fix this issue should be those ones:
https://github.com/bcgit/bc-java/commit/5cb2f05
https://github.com/bcgit/bc-java/commit/e25e94a

A CVE has been requested here:
http://www.openwall.com/lists/oss-security/2015/10/22/7

-- System Information:
Debian Release: stretch/sid
  APT prefers squeeze-lts
  APT policy: (500, 'squeeze-lts'), (500, 'oldoldstable'), (500, 'unstable'), 
(500, 'testing'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.2.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

--- End Message ---
--- Begin Message ---
Source: bouncycastle
Source-Version: 1.44+dfsg-2+deb6u1

We believe that the bug you reported is fixed in the latest version of
bouncycastle, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Raphaël Hertzog <hert...@debian.org> (supplier of updated bouncycastle package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 22 Oct 2015 12:05:19 +0200
Source: bouncycastle
Binary: libbcprov-java libbcprov-java-doc libbcmail-java libbcmail-java-doc 
libbctsp-java libbctsp-java-doc libbcpg-java libbcpg-java-doc 
libbcprov-java-gcj libbcmail-java-gcj libbctsp-java-gcj libbcpg-java-gcj
Architecture: source all amd64
Version: 1.44+dfsg-2+deb6u1
Distribution: squeeze-lts
Urgency: medium
Maintainer: Debian Java Maintainers 
<pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Raphaël Hertzog <hert...@debian.org>
Description: 
 libbcmail-java - Bouncy Castle generators/processors for S/MIME and CMS
 libbcmail-java-doc - Documentation for libbcmail-java
 libbcmail-java-gcj - Bouncy Castle generators/processors for S/MIME and CMS
 libbcpg-java - Bouncy Castle generators/processors for OpenPGP
 libbcpg-java-doc - Documentation for libbcpg-java
 libbcpg-java-gcj - Bouncy Castle generators/processors for OpenPGP
 libbcprov-java - Bouncy Castle Java Cryptographic Service Provider
 libbcprov-java-doc - Documentation for libbcprov-java
 libbcprov-java-gcj - Bouncy Castle Java Cryptographic Service Provider
 libbctsp-java - Bouncy Castle generators/processors for TSP
 libbctsp-java-doc - Documentation for libbctsp-java
 libbctsp-java-gcj - Bouncy Castle generators/processors for TSP
Closes: 802671
Changes: 
 bouncycastle (1.44+dfsg-2+deb6u1) squeeze-lts; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS team.
   * CVE-2015-7940: fix invalid curve attack as described in
     
http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html
     Closes: #802671
   * Add ant-optional to Build-Depends to be able to run the test suite during
     build.
Checksums-Sha1: 
 61faa349babb7fcdb768fa6bf7c583015911cd32 1930 
bouncycastle_1.44+dfsg-2+deb6u1.dsc
 78cde78db9930fd1a84f50c21a654af4accb008f 19167 
bouncycastle_1.44+dfsg-2+deb6u1.diff.gz
 5a7e3aaee20a5f67cbfac34f9d4cd4cf14ddd0ed 1383358 
libbcprov-java_1.44+dfsg-2+deb6u1_all.deb
 8e70a0e8b3b729f7241d118be929c5a81f627058 1691634 
libbcprov-java-doc_1.44+dfsg-2+deb6u1_all.deb
 531b27c880e071294a348c25a2f5d417366c06bf 237960 
libbcmail-java_1.44+dfsg-2+deb6u1_all.deb
 df70ba2e33a1466a2d2993db7cc89a9aae961368 189362 
libbcmail-java-doc_1.44+dfsg-2+deb6u1_all.deb
 c106b8f045f36c575d496aecedf5c53b4f0841d7 69160 
libbctsp-java_1.44+dfsg-2+deb6u1_all.deb
 a5191e72b6992502fb80c2ec886c3dd9a2c58369 30892 
libbctsp-java-doc_1.44+dfsg-2+deb6u1_all.deb
 a256a5c08450b5ee8071e4eb3f6cc84b2c670978 186982 
libbcpg-java_1.44+dfsg-2+deb6u1_all.deb
 1be6f56081f2ae0f88bb325d40ab7d50079cb876 157068 
libbcpg-java-doc_1.44+dfsg-2+deb6u1_all.deb
 c2e2d670c3ef7bc4092c075826480c8584b0c8d6 2140766 
libbcprov-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 3f9d5de9aa6b0dc375b364e88d3680168309b009 278498 
libbcmail-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 00849b4a0ec74e2f36e49ef60ec2a42d12f2e4a7 38506 
libbctsp-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 4b04465b2afb045c9900ef172552c0e1c74f0c88 239292 
libbcpg-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
Checksums-Sha256: 
 429048e95c5ce48f99771391ece1618c0bbf5ad223f72c1580aee0032e18adc2 1930 
bouncycastle_1.44+dfsg-2+deb6u1.dsc
 53111f669aea3b5470649e1bcf2cc72ebd21d2e57d420a634b1df503978e63be 19167 
bouncycastle_1.44+dfsg-2+deb6u1.diff.gz
 f6a22ab9bfc71eeae51f67db60e279fe36dc74c8783b0e7677060874152e651b 1383358 
libbcprov-java_1.44+dfsg-2+deb6u1_all.deb
 051e589be0fd384016e47b20e8f5adb6fbed7e2c0b414e983e8ee285690b772d 1691634 
libbcprov-java-doc_1.44+dfsg-2+deb6u1_all.deb
 91c5680cc9a8f6b16385d7a1696fdbb538801b2585bd8f8e5f6e4362f8b7d032 237960 
libbcmail-java_1.44+dfsg-2+deb6u1_all.deb
 cd649d1e84c1e60b601e4c5484a9d0ba9b203d3f206f8f339dd76f44aefe5a72 189362 
libbcmail-java-doc_1.44+dfsg-2+deb6u1_all.deb
 3d5ad4d4e21382fd5113de79485fa546d109e217c3e488debbdced421c99ff89 69160 
libbctsp-java_1.44+dfsg-2+deb6u1_all.deb
 9e848ad5c814483f0cd29f5f0317e73d2c3f19f0d4c0edefac2bd7d3cf7b348c 30892 
libbctsp-java-doc_1.44+dfsg-2+deb6u1_all.deb
 57fc1fec42bfa84736d8babb98c2ba4146ec57edd42b9ec20302226e4183f151 186982 
libbcpg-java_1.44+dfsg-2+deb6u1_all.deb
 2b0d8f6a71830cda7a5a3787414c42123cc1f9875245fe46755afbda0da2ec34 157068 
libbcpg-java-doc_1.44+dfsg-2+deb6u1_all.deb
 e5feef0372d8cadb1d65556b43a288ce14bea9798b573158c1ccca674cea569e 2140766 
libbcprov-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 ada6428f0ecdd4b2819d86fa26f0842488459e2807b430bba0245e29621090f3 278498 
libbcmail-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 0eb5ecef9243e69894c821eebfff5c21101cb84f5e7dd8c06d8b8e9116f637e4 38506 
libbctsp-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 5aff6931318c540c37ed89be0905dfaabd5f67d836863c7401a53eb611cd038e 239292 
libbcpg-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
Files: 
 57b4ab92db9e09eb485bff52f3036648 1930 libs optional 
bouncycastle_1.44+dfsg-2+deb6u1.dsc
 ecaafd8fc4a3d8b7f42b2736a47e0a25 19167 libs optional 
bouncycastle_1.44+dfsg-2+deb6u1.diff.gz
 bf4142ee6ce1da524969a1783b3f56d3 1383358 java optional 
libbcprov-java_1.44+dfsg-2+deb6u1_all.deb
 5f826336a118b2e96275908c87b65364 1691634 doc optional 
libbcprov-java-doc_1.44+dfsg-2+deb6u1_all.deb
 f993780e0b13024f1af63181bf99d930 237960 java optional 
libbcmail-java_1.44+dfsg-2+deb6u1_all.deb
 6bf7c899ca9a05e324d801058fc0b0cc 189362 doc optional 
libbcmail-java-doc_1.44+dfsg-2+deb6u1_all.deb
 16088a4e205a3d2e05a8801b91f4797a 69160 java optional 
libbctsp-java_1.44+dfsg-2+deb6u1_all.deb
 5eb138e920710b4dc0ec3658187e1586 30892 doc optional 
libbctsp-java-doc_1.44+dfsg-2+deb6u1_all.deb
 0549ba7feeaef54fdfa2a78a14e2ea0b 186982 java optional 
libbcpg-java_1.44+dfsg-2+deb6u1_all.deb
 5df721192c6fdfe9f7a9285bb1e3c8ab 157068 doc optional 
libbcpg-java-doc_1.44+dfsg-2+deb6u1_all.deb
 c739ce01714b541a32b94b3eaf759b73 2140766 libs optional 
libbcprov-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 50c0f49d0bfd3984dba226d25c305662 278498 libs optional 
libbcmail-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 d16ee6ef3c98b25994a5530aa36b1ad1 38506 libs optional 
libbctsp-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb
 f52084f6445ca1cb9e7264b204f90970 239292 libs optional 
libbcpg-java-gcj_1.44+dfsg-2+deb6u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Signed by Raphael Hertzog

iQEcBAEBCAAGBQJWZrfOAAoJEAOIHavrwpq5ZM8H/i4n/SI/7HQ0CIl31RCly7+d
6BIcmL0BaXciPODY7db16kP/9bsSD8F7qhbLZx2iZOmdm5dBDeS4Rht7xJ4+U05u
8WFl9cMBiWgWx4Qgm/CCSIKcO+yuqblQ/8ieiYl2D2wsaHazrcUdNrKNQ6VCYyMh
/ZGO3Hhlgc4qJQKfRnn0wPo48wdawzJd8nPOO59z8OBgFm6BEGyrXQSwqFj+/u3P
VUc+dePyLGNfKYopf/vcXlmi/nLHAAhevTQHQ8ZyUZwC3XcuzQI0xZJErI40XkU9
uO9zTZ/mORHQ9EUdHwXQ2fcQjkftduWSi+2wgOmkQ8nwSJeLwblU7Vr5MrERbtI=
=DLQi
-----END PGP SIGNATURE-----

--- End Message ---
__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. 
Please use
debian-j...@lists.debian.org for discussions and questions.

Reply via email to