Debian Package Tracker

general

source: hesiod (main)
version: 3.2.1-3
maintainer: Karl Ramm [DMD]
uploaders: Alexander Chernyakhovsky [DMD]
arch: any
std-ver: 3.9.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.0.2-21
o-o-sec: 3.0.2-21+deb7u1
oldstable: 3.2.1-3
stable: 3.2.1-3
testing: 3.2.1-3
unstable: 3.2.1-3

versioned links

3.0.2-21: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.2-21+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

hesiod
libhesiod-dev
libhesiod0

action needed

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 3.9.4).

Created: 2017-01-24 Last update: 2018-12-23 17:14

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2016-10152: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
CVE-2016-10151: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.

Please fix them.

Created: 2017-06-18 Last update: 2018-06-02 08:03

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2016-10152: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
CVE-2016-10151: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.

Please fix them.

Created: 2017-01-21 Last update: 2018-06-02 08:03

lintian reports 7 warnings high

Lintian reports 7 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-07 Last update: 2017-10-19 07:12

Depends on packages which need a new maintainer normal

The packages that hesiod depends on which need a new maintainer are:

dh-exec (#851746)
- Build-Depends: dh-exec

Created: 2017-12-02 Last update: 2019-01-19 03:00

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2018-10-01 Last update: 2019-01-19 00:03

12 new commits since last upload, time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 39b21dac9bc6473365de04d94be0da94941c7c73
Author: Nalin Dahyabhai <nalin@redhat.com>
Date:   Tue May 3 13:32:25 2016 -0400

    Use secure_getenv() when it's available
    
    Factor out logic that attempts to only consult the environment when it's
    safe to do so into its own function, and use secure_getenv() instead of
    getenv() if it's available.  Original report from
    https://bugzilla.redhat.com/show_bug.cgi?id=1332508

commit fc0e1d7db42fa931f80982c6d3326375b7e3b266
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Mon Feb 22 16:08:25 2016 -0500

    Correct systest pobox

commit 377d59c98993a35e3d42661a504f892e394a8f70
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Fri Jun 6 01:48:58 2014 -0400

    Don't purge hesiod.conf until last package

commit 0f7999db78e54dc6adb4ec692e71700b655f0dc4
Author: Adam Glasgall <glasgall@mit.edu>
Date:   Mon Sep 30 11:00:28 2013 -0400

    Allow specifying a path to libidn headers (fixes build on OpenSolaris)

commit 5e02bd2b096e6533acfdce22f32912a451ca2814
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Mon Jul 8 18:45:10 2013 -0400

    Convert README to markdown

commit 6efbca6c880c55cc7efc15b5739b702e6a929b4e
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Mon Jul 8 18:08:56 2013 -0400

    In travis-ci, show build messages and run tests properly

commit 7d8efa3cfd36489579a7e26dc23cfac366208c38
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Mon Jul 8 18:05:49 2013 -0400

    Lower autoconf requirement to 2.65

commit a9dd4d7c648ab3f5ed1558f8f25145fdcdb2b03c
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Mon Jul 8 17:59:19 2013 -0400

    Add a travis-ci configuration file

commit 3f3116f610e367005e1c5c64d1c912f5ce6c7202
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Fri Jun 14 17:28:22 2013 -0400

    Fix Debian FTBFS and other warnings

commit 30729f8ee21d3c718442f0ecb95a2a1b9e364a74
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Tue Apr 9 19:26:07 2013 -0400

    Clean up configure.ac checks

commit e57a6809c7a8e37be20d99a6bcaefbd2860c632f
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Wed Apr 3 02:21:36 2013 -0400

    Also .gitignore INSTALL

commit 516cc3e512fc0e0cb79fb76b4e528b3da7505350
Author: Alexander Chernyakhovsky <achernya@mit.edu>
Date:   Wed Apr 3 02:18:36 2013 -0400

    Drop INSTALL; it's autogenerated.

Created: 2017-12-03 Last update: 2019-01-18 09:30

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2016-10152: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
CVE-2016-10151: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.

Please fix them.

Created: 2017-01-21 Last update: 2018-06-02 08:03

2 ignored security issues in jessie low

There are 2 open security issues in jessie.

2 issues skipped by the security teams:

CVE-2016-10152: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
CVE-2016-10151: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.

Please fix them.

Created: 2017-01-21 Last update: 2018-06-02 08:03

news

[rss feed]

[2017-01-23] Accepted hesiod 3.0.2-21+deb7u1 (source amd64) into oldstable (Chris Lamb)
[2014-06-11] hesiod 3.2.1-3 MIGRATED to testing (Debian testing watch)
[2014-06-06] Accepted hesiod 3.2.1-3 (source amd64) (Alexander Chernyakhovsky)
[2013-06-26] hesiod 3.2.1-2 MIGRATED to testing (Debian testing watch)
[2013-06-14] Accepted hesiod 3.2.1-2 (source amd64) (Alexander Chernyakhovsky)
[2013-05-05] hesiod 3.2.1-1 MIGRATED to testing (Debian testing watch)
[2013-04-03] Accepted hesiod 3.2.1-1 (source amd64) (Alexander Chernyakhovsky)
[2012-02-12] hesiod 3.0.2-21 MIGRATED to testing (Debian testing watch)
[2012-02-01] Accepted hesiod 3.0.2-21 (source amd64) (Karl Ramm)
[2010-01-27] hesiod 3.0.2-20 MIGRATED to testing (Debian testing watch)
[2010-01-15] Accepted hesiod 3.0.2-20 (source i386) (Karl Ramm)
[2009-03-22] hesiod 3.0.2-19 MIGRATED to testing (Debian testing watch)
[2009-03-12] Accepted hesiod 3.0.2-19 (source i386) (Karl Ramm)
[2008-10-31] hesiod 3.0.2-18.3 MIGRATED to testing (Debian testing watch)
[2008-10-12] Accepted hesiod 3.0.2-18.3 (source i386) (Christian Perrier)
[2008-04-10] hesiod 3.0.2-18.2 MIGRATED to testing (Debian testing watch)
[2008-03-15] Accepted hesiod 3.0.2-18.2 (source i386) (Christian Perrier)
[2007-02-01] hesiod 3.0.2-18.1 MIGRATED to testing (Debian testing watch)
[2007-01-21] Accepted hesiod 3.0.2-18.1 (source i386) (Christian Perrier)
[2006-10-27] hesiod 3.0.2-18 MIGRATED to testing (Debian testing watch)
[2006-10-17] hesiod 3.0.2-17.1 MIGRATED to testing (Debian testing watch)
[2006-10-16] Accepted hesiod 3.0.2-18 (source i386) (Karl Ramm)
[2006-10-04] Accepted hesiod 3.0.2-17.1 (source i386) (Christian Perrier)
[2005-08-05] Accepted hesiod 3.0.2-16 (source i386) (Steve Langasek)
[2004-05-14] Accepted hesiod 3.0.2-15.1 (i386 source) (Guillem Jover)
[2003-09-07] Accepted hesiod 3.0.2-15 (source i386 alpha) (Steve Langasek)
[2003-07-26] Accepted hesiod 3.0.2-14 (source i386 alpha) (Steve Langasek)
[2002-12-09] Accepted hesiod 3.0.2-13 (i386 source) (Steve Langasek)
[2002-04-25] Accepted hesiod 3.0.2-12 (arm mipsel alpha ia64 mips i386 source hppa m68k sparc powerpc s390) (Steve Langasek)
[2002-03-21] Accepted hesiod 3.0.2-11 (alpha i386 source) (Steve Langasek)

bugs [bug history graph]

all: 5
RC: 2
I&N: 0
M&W: 3
F&P: 0
patch: 1

links

lintian (0, 7)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.2.1-3build1