Bug#993592: libgda5: CVE-2021-39359

2023-01-02 Thread Salvatore Bonaccorso 
Hi,

On Sun, Jan 01, 2023 at 09:50:00PM +0100, Bastian Germann wrote:
> libgda 6.0 is now available for 10 months. Is anyone up to import it into 
> Debian?

For the CVE in question of this bugreport alternatively the upstream
commit is:
https://gitlab.gnome.org/GNOME/libgda/-/commit/bebdffb4de586fb43fd07ac549121f4b22f6812d
(note it's not included in LIBGDA_6_0_0 and will still be needed to be
picked on top afaics).

Regards,
Salvatore

Bug#993592: libgda5: CVE-2021-39359

2023-01-01 Thread Bastian Germann 

libgda 6.0 is now available for 10 months. Is anyone up to import it into 
Debian?

Bug#993592: libgda5: CVE-2021-39359

2021-09-03 Thread Salvatore Bonaccorso 
Source: libgda5
Version: 5.2.9-2
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libgda/-/issues/249
X-Debbugs-Cc: car...@debian.org, Debian Security Team 

Hi,

The following vulnerability was published for libgda5.

CVE-2021-39359[0]:
| In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS
| certificate verification on the SoupSessionSync objects it creates,
| leaving users vulnerable to network MITM attacks. NOTE: this is
| similar to CVE-2016-20011.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-39359
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39359
[1] https://gitlab.gnome.org/GNOME/libgda/-/issues/249

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore