[SECURITY] [DLA 1945-1] openconnect security update

2019-10-0401:31:24

lists.debian.org

134

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.5%

JSON

Package : openconnect
Version : 6.00-2+deb8u1
CVE ID : CVE-2019-16239
Debian Bug : 940871

A vulnerability was discovered by Lukas Kupczyk of the Advanced Research
Team at CrowdStrike Intelligence in OpenConnect, an open client for
Cisco AnyConnect, Pulse, GlobalProtect VPN. A malicious HTTP server
(after its identity certificate has been accepted) can provide bogus
chunk lengths for chunked HTTP encoding and cause a heap overflow.

For Debian 8 "Jessie", this problem has been fixed in version
6.00-2+deb8u1.

We recommend that you upgrade your openconnect packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian10armhfopenconnect-dbgsym< 8.02-1+deb10u1openconnect-dbgsym_8.02-1+deb10u1_armhf.deb
Debian10mips64elopenconnect< 8.02-1+deb10u1openconnect_8.02-1+deb10u1_mips64el.deb
Debian10i386libopenconnect5-dbgsym< 8.02-1+deb10u1libopenconnect5-dbgsym_8.02-1+deb10u1_i386.deb
Debian8amd64openconnect-dbg< 6.00-2+deb8u1openconnect-dbg_6.00-2+deb8u1_amd64.deb
Debian9ppc64elopenconnect< 7.08-1+deb9u1openconnect_7.08-1+deb9u1_ppc64el.deb
Debian9arm64openconnect< 7.08-1+deb9u1openconnect_7.08-1+deb9u1_arm64.deb
Debian10mipsopenconnect< 8.02-1+deb10u1openconnect_8.02-1+deb10u1_mips.deb
Debian9s390xopenconnect-dbg< 7.08-1+deb9u1openconnect-dbg_7.08-1+deb9u1_s390x.deb
Debian9amd64openconnect< 7.08-1+deb9u1openconnect_7.08-1+deb9u1_amd64.deb
Debian9arm64libopenconnect5< 7.08-1+deb9u1libopenconnect5_7.08-1+deb9u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armhf	openconnect-dbgsym	< 8.02-1+deb10u1	openconnect-dbgsym_8.02-1+deb10u1_armhf.deb
Debian	10	mips64el	openconnect	< 8.02-1+deb10u1	openconnect_8.02-1+deb10u1_mips64el.deb
Debian	10	i386	libopenconnect5-dbgsym	< 8.02-1+deb10u1	libopenconnect5-dbgsym_8.02-1+deb10u1_i386.deb
Debian	8	amd64	openconnect-dbg	< 6.00-2+deb8u1	openconnect-dbg_6.00-2+deb8u1_amd64.deb
Debian	9	ppc64el	openconnect	< 7.08-1+deb9u1	openconnect_7.08-1+deb9u1_ppc64el.deb
Debian	9	arm64	openconnect	< 7.08-1+deb9u1	openconnect_7.08-1+deb9u1_arm64.deb
Debian	10	mips	openconnect	< 8.02-1+deb10u1	openconnect_8.02-1+deb10u1_mips.deb
Debian	9	s390x	openconnect-dbg	< 7.08-1+deb9u1	openconnect-dbg_7.08-1+deb9u1_s390x.deb
Debian	9	amd64	openconnect	< 7.08-1+deb9u1	openconnect_7.08-1+deb9u1_amd64.deb
Debian	9	arm64	libopenconnect5	< 7.08-1+deb9u1	libopenconnect5_7.08-1+deb9u1_arm64.deb