Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-14 Thread Rene Mayorga
On Tue, Jan 13, 2009 at 11:48:00AM -0600, Rene Mayorga wrote: > On Tue, Jan 13, 2009 at 06:29:10PM +0100, Steffen Moeller wrote: > > Frank S. Thomas wrote: > > > On Tuesday 13 January 2009 16:43:55 Rene Mayorga wrote: > > >> I was about to port this fix to 6.2.14-2, are everybody ok with this? > >

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Rene Mayorga
On Tue, Jan 13, 2009 at 06:29:10PM +0100, Steffen Moeller wrote: > Frank S. Thomas wrote: > > On Tuesday 13 January 2009 16:43:55 Rene Mayorga wrote: > >> I was about to port this fix to 6.2.14-2, are everybody ok with this? > > > > FWIW: I'm ok with backporting this to the current version in Lenn

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Steffen Moeller
Frank S. Thomas wrote: > On Tuesday 13 January 2009 16:43:55 Rene Mayorga wrote: >> I was about to port this fix to 6.2.14-2, are everybody ok with this? > > FWIW: I'm ok with backporting this to the current version in Lenny. Lenny should not be without it, good point. My comment referred to my

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Frank S. Thomas
On Tuesday 13 January 2009 16:43:55 Rene Mayorga wrote: > I was about to port this fix to 6.2.14-2, are everybody ok with this? FWIW: I'm ok with backporting this to the current version in Lenny. signature.asc Description: This is a digitally signed message part.

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Steffen Moeller
Rene Mayorga wrote: > On Tue, Jan 13, 2009 at 04:24:27PM +0100, Steffen Moeller wrote: >> marcos.mar...@sonae.com wrote: >>> Upstream has a fix for this: >>> http://boinc.berkeley.edu/trac/changeset/16883 >> and they have introduced another since it may be "en- or decryption", not >> only >> "encr

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Rene Mayorga
On Tue, Jan 13, 2009 at 04:24:27PM +0100, Steffen Moeller wrote: > marcos.mar...@sonae.com wrote: > > Upstream has a fix for this: > > http://boinc.berkeley.edu/trac/changeset/16883 > > and they have introduced another since it may be "en- or decryption", not only > "encryption" as their error mes

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread Steffen Moeller
marcos.mar...@sonae.com wrote: > Upstream has a fix for this: > http://boinc.berkeley.edu/trac/changeset/16883 and they have introduced another since it may be "en- or decryption", not only "encryption" as their error message indicates. Whenever there is the next Debian release, this bug will be

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-13 Thread marcos.marado
Upstream has a fix for this: http://boinc.berkeley.edu/trac/changeset/16883 Best regards, -- Marcos Marado -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#511521: boinc: Does not check the RSA_public_decrypt() return value.

2009-01-11 Thread Kurt Roeckx
Package: boinc Severity: serious Tags: security Hi, I've been checking packages to see if they properly check the return value of some of the functions in openssl. In lib/crypt.C there is this code: int decrypt_public(R_RSA_PUBLIC_KEY& key, DATA_BLOCK& in, DATA_BLOCK& out) { RSA* rp = RSA_ne