lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 18 Dec 2019 22:41:36 +0000
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4589-1] debian-edu-config security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4589-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
December 18, 2019                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : debian-edu-config
CVE ID         : CVE-2019-3467
Debian Bug     : 946797

It was discovered that debian-edu-config, a set of configuration files
used for the Debian Edu blend, configured too permissive ACLs for the
Kerberos admin server, which allowed password changes for other user
principals.

For the oldstable distribution (stretch), this problem has been fixed
in version 1.929+deb9u4.

For the stable distribution (buster), this problem has been fixed in
version 2.10.65+deb10u3.

We recommend that you upgrade your debian-edu-config packages.

For the detailed security status of debian-edu-config please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/debian-edu-config

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl36qpMACgkQEMKTtsN8
TjaKSBAAjXOOr5I57eoEY2jJXEWblgb/qbjcLdgwgkDuxhD1lN1mXDRDK7uOdKif
g4s4omVNlVe/g3rwJCqBByqBDeUK2KCYk2mqdbsbhQrZbz6HrPjwh309ewuORh+o
uWFF8ieD0yHKzE4VnbwNMcKInFzszALFP7zSbIdCKV/JDigUo/CrpPRTpYIa8Z3W
Xak7QqXotFE1qPlXQZURqgHcO9ZcdStwHxWpEZo5FpiF9oUl2KHsEKhv2lfdopzW
B477GpaCufa8nH2X4ahw3W4Idlm2GAJma6Sagk7BHqlHQAvE46q/qLLVjfCTFcis
je5J0vaVZg5OIiAE1D+mS4bYeio4OZJWaLOf7/6rArWHN3lcrfhMuFDYrSvaURJs
i+bMJxbguNZ/V66Ij5mQmq8PfSM3+nxEp5LbUrQ2KFZAx5/c1LtxzlUi5y3YKXrS
bMEuk+6w9NFWx1KGzPRM9aa+4a95DpJlof67VE3sSeXBc6YtBxf5VqXm6bh1jE7Z
S4uXyYdaMXpJT4lIjKX7LC1g1Z7j8X8tNKuIx7F5LDYnQEZK+aKuCKRZai5a0B4g
OtkgTROsJ2zQ+xg5go3zorqx6WJECwWRyFJwVdItqyBrlJ1QX2UeaYuvFB7KS/BO
8yCLdYR1oHR6FEMOxK7NfuR7gjW4VHBscsGlxUIZyu2IMF0Suec=
=6lpd
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists