fastnetmon - Debian Package Tracker

general

source: fastnetmon (main)
version: 1.2.9-1
maintainer: Patrick Matthäi (DMD)
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.2.4-2+deb12u1
old-sec: 1.2.4-2+deb12u1
old-bpo: 1.2.8-1~bpo12+1
stable: 1.2.9-0+deb13u1
stable-sec: 1.2.9-0+deb13u1
testing: 1.2.9-1
unstable: 1.2.9-1

versioned links

1.2.4-2+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.7-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.8-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.9-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

fastnetmon

action needed

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-48682: FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
CVE-2026-48697: FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.

Created: 2026-05-27 Last update: 2026-07-15 11:30

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-48682: FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
CVE-2026-48697: FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.

Created: 2026-05-27 Last update: 2026-07-15 11:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.2.9-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 4444dbb9ae80d2a510b8a444f4ca37267e32160e
Author: Patrick Matthäi <pmatthaei@debian.org>
Date:   Wed Jul 8 11:04:30 2026 +0200

    * Merge 1.2.9-0+deb13u1 changelog.

https://salsa.debian.org/api/v4/projects/debian%2Ffastnetmon API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-08 Last update: 2026-07-30 04:20

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-48682: (needs triaging) FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
CVE-2026-48697: (needs triaging) FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-05-27 Last update: 2026-07-15 11:30

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2026-48682: (postponed; to be fixed through a stable update) FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.
CVE-2026-48697: (needs triaging) FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-05-27 Last update: 2026-07-15 11:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-06-02 19:31

testing migrations

This package will soon be part of the auto-protobuf transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-grpc transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-07-04] Accepted fastnetmon 1.2.9-0+deb13u1 (source amd64) into proposed-updates (Debian FTP Masters) (signed by: Patrick Matthäi)
[2026-07-02] Accepted fastnetmon 1.2.9-0+deb13u1 (source amd64) into stable-security (Debian FTP Masters) (signed by: Patrick Matthäi)
[2026-06-04] fastnetmon 1.2.9-1 MIGRATED to testing (Debian testing watch)
[2026-06-02] Accepted fastnetmon 1.2.9-1 (source) into unstable (Patrick Matthäi)
[2026-02-17] fastnetmon 1.2.8+git20250911-2 MIGRATED to testing (Debian testing watch)
[2026-02-10] Accepted fastnetmon 1.2.8+git20250911-2 (source) into unstable (Patrick Matthäi)
[2025-09-17] fastnetmon 1.2.8+git20250911-1 MIGRATED to testing (Debian testing watch)
[2025-09-11] Accepted fastnetmon 1.2.8+git20250911-1 (source) into unstable (Patrick Matthäi)
[2025-03-06] Accepted fastnetmon 1.2.8-1~bpo12+1 (source) into stable-backports (Patrick Matthäi)
[2024-12-29] Accepted fastnetmon 1.2.4-2+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Patrick Matthäi)
[2024-12-26] Accepted fastnetmon 1.2.4-2+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Patrick Matthäi)
[2024-12-25] fastnetmon 1.2.8-1 MIGRATED to testing (Debian testing watch)
[2024-12-23] Accepted fastnetmon 1.2.8-1 (source) into unstable (Patrick Matthäi)
[2024-07-15] Accepted fastnetmon 1.2.7-1~bpo12+1 (source) into stable-backports (Patrick Matthäi)
[2024-07-14] fastnetmon 1.2.7-1 MIGRATED to testing (Debian testing watch)
[2024-07-08] Accepted fastnetmon 1.2.7-1 (source) into unstable (Patrick Matthäi)
[2023-11-06] Accepted fastnetmon 1.2.6-1~bpo12+1 (source) into stable-backports (Patrick Matthäi)
[2023-11-01] Accepted fastnetmon 1.2.5-2~bpo12+1 (source amd64) into stable-backports (Debian FTP Masters) (signed by: Patrick Matthäi)
[2023-11-01] fastnetmon 1.2.6-1 MIGRATED to testing (Debian testing watch)
[2023-10-27] Accepted fastnetmon 1.2.6-1 (source) into unstable (Patrick Matthäi)
[2023-08-28] fastnetmon 1.2.5-2 MIGRATED to testing (Debian testing watch)
[2023-08-23] Accepted fastnetmon 1.2.5-2 (source) into unstable (Patrick Matthäi)
[2023-07-09] fastnetmon 1.2.5-1 MIGRATED to testing (Debian testing watch)
[2023-07-04] Accepted fastnetmon 1.2.5-1 (source) into unstable (Patrick Matthäi)
[2023-04-11] fastnetmon 1.2.4-2 MIGRATED to testing (Debian testing watch)
[2023-03-14] Accepted fastnetmon 1.2.4-2 (source) into unstable (Patrick Matthäi)
[2023-03-09] Accepted fastnetmon 1.2.4-1 (source) into unstable (Patrick Matthäi)
[2023-01-01] fastnetmon 1.2.3-3 MIGRATED to testing (Debian testing watch)
[2022-12-27] Accepted fastnetmon 1.2.3-3 (source) into unstable (Patrick Matthäi)
[2022-11-13] fastnetmon 1.2.3-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.2.9-1build1