Debian Package Tracker
Register | Log in
Subscribe

libtomcrypt

Choose email to subscribe with

general
  • source: libtomcrypt (main)
  • version: 1.18.2-2
  • maintainer: Nicolas Mora (DMD)
  • arch: any
  • std-ver: 4.3.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1.17-6
  • o-o-sec: 1.17-6+deb8u1
  • oldstable: 1.17-9
  • stable: 1.18.2-1
  • testing: 1.18.2-2
  • unstable: 1.18.2-2
versioned links
  • 1.17-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.17-6+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.17-9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.18.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.18.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libtomcrypt-dev (1 bugs: 0, 1, 0, 0)
  • libtomcrypt1
action needed
The VCS repository is not up to date, push the missing commits. high
vcswatch reports that this package has been uploaded into the archive but the debian/changelog in the VCS is still UNRELEASED. You should consider pushing the missing commits or updating the VCS.
Created: 2018-05-31 Last update: 2019-12-03 07:13
1 security issue in bullseye high
There is 1 open security issue in bullseye.
1 important issue:
  • CVE-2019-17362: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Please fix it.
Created: 2019-10-09 Last update: 2019-12-03 00:16
1 security issue in sid high
There is 1 open security issue in sid.
1 important issue:
  • CVE-2019-17362: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Please fix it.
Created: 2019-10-09 Last update: 2019-12-03 00:16
1 bug tagged patch in the BTS normal
The BTS contains patches fixing 1 bug, consider including or untagging them.
Created: 2019-04-01 Last update: 2019-12-06 15:33
Depends on packages which need a new maintainer normal
The packages that libtomcrypt depends on which need a new maintainer are:
  • dh-exec (#851746)
    • Build-Depends: dh-exec
Created: 2019-11-22 Last update: 2019-12-06 14:14
Does not build reproducibly during testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2018-09-11 Last update: 2019-12-06 11:09
lintian reports 1 warning normal
Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.
Created: 2019-08-26 Last update: 2019-08-28 02:37
1 ignored security issue in buster low
There is 1 open security issue in buster.
1 issue skipped by the security teams:
  • CVE-2019-17362: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Please fix it.
Created: 2019-10-09 Last update: 2019-12-03 00:16
3 ignored security issues in jessie low
There are 3 open security issues in jessie.
3 issues skipped by the security teams:
  • CVE-2018-12437: LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
  • CVE-2016-6129: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
  • CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Please fix them.
Created: 2016-09-03 Last update: 2019-12-03 00:16
3 ignored security issues in stretch low
There are 3 open security issues in stretch.
3 issues skipped by the security teams:
  • CVE-2018-12437: LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
  • CVE-2019-17362: In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
  • CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Please fix them.
Created: 2018-06-15 Last update: 2019-12-03 00:16
Build log checks report 1 warning low
Build log checks report 1 warning
Created: 2019-07-15 Last update: 2019-07-15 08:20
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.3.0).
Created: 2018-01-22 Last update: 2019-09-29 23:40
news
[rss feed]
  • [2019-10-09] Accepted libtomcrypt 1.17-6+deb8u1 (source amd64) into oldoldstable (Chris Lamb)
  • [2019-07-17] libtomcrypt 1.18.2-2 MIGRATED to testing (Debian testing watch)
  • [2019-07-14] Accepted libtomcrypt 1.18.2-2 (source) into unstable (Nicolas Mora) (signed by: Thorsten Alteholz)
  • [2018-07-17] libtomcrypt 1.18.2-1 MIGRATED to testing (Debian testing watch)
  • [2018-07-11] Accepted libtomcrypt 1.18.2-1 (source) into unstable (Michael Stapelberg)
  • [2018-01-27] libtomcrypt 1.18.1-1 MIGRATED to testing (Debian testing watch)
  • [2018-01-22] Accepted libtomcrypt 1.18.1-1 (source) into unstable (Michael Stapelberg)
  • [2017-10-21] libtomcrypt 1.18.0-1 MIGRATED to testing (Debian testing watch)
  • [2017-10-16] Accepted libtomcrypt 1.18.0-1 (source amd64) into unstable, unstable (Michael Stapelberg)
  • [2016-12-29] libtomcrypt 1.17-9 MIGRATED to testing (Debian testing watch)
  • [2016-12-18] Accepted libtomcrypt 1.17-9 (source) into unstable (Michael Stapelberg)
  • [2016-09-16] libtomcrypt 1.17-8 MIGRATED to testing (Debian testing watch)
  • [2016-09-13] Accepted libtomcrypt 1.17-8 (source amd64) into unstable (Michael Stapelberg)
  • [2016-09-06] Accepted libtomcrypt 1.17-3.2+deb7u1 (source amd64) into oldstable (Jonas Meurer)
  • [2015-07-04] libtomcrypt 1.17-7 MIGRATED to testing (Britney)
  • [2015-06-28] Accepted libtomcrypt 1.17-7 (source amd64) into unstable (Michael Stapelberg)
  • [2014-10-05] libtomcrypt 1.17-6 MIGRATED to testing (Britney)
  • [2014-09-29] Accepted libtomcrypt 1.17-6 (source amd64) into unstable (Michael Stapelberg)
  • [2014-01-15] libtomcrypt 1.17-5 MIGRATED to testing (Debian testing watch)
  • [2014-01-04] Accepted libtomcrypt 1.17-5 (source amd64) (Michael Stapelberg)
  • [2014-01-02] Accepted libtomcrypt 1.17-4 (source amd64) (Michael Stapelberg)
  • [2011-07-12] libtomcrypt 1.17-3.2 MIGRATED to testing (Debian testing watch)
  • [2011-07-01] Accepted libtomcrypt 1.17-3.2 (source i386) (Luk Claes)
  • [2011-03-29] libtomcrypt 1.17-3.1 MIGRATED to testing (Debian testing watch)
  • [2011-03-18] Accepted libtomcrypt 1.17-3.1 (source amd64) (Steve M. Robbins) (signed by: Steven M. Robbins)
  • [2011-02-06] libtomcrypt 1.17-3 MIGRATED to testing (Debian testing watch)
  • [2011-01-12] Accepted libtomcrypt 1.17-3 (source amd64) (Michael Stapelberg)
  • [2009-12-11] libtomcrypt 1.17-2 MIGRATED to testing (Debian testing watch)
  • [2009-11-30] Accepted libtomcrypt 1.17-2 (source amd64) (Michael Stapelberg)
  • [2009-07-26] libtomcrypt 1.17-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 3
  • RC: 0
  • I&N: 2
  • M&W: 1
  • F&P: 0
  • patch: 1
links
  • homepage
  • lintian (0, 1)
  • buildd: logs, checks, clang, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • security tracker
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1.18.2-2
  • 1 bug

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing