Debian Long Term Support / LTS Security Information / 2018 / Security Information -- DLA-1594-1 xml-security-c

Debian Security Advisory

DLA-1594-1 xml-security-c -- LTS security update

Date Reported:

24 Nov 2018

Affected Packages:

xml-security-c

Vulnerable:

Yes

Security database references:

No other external database security references currently available.

More information:

A vulnerability in xml-security-c, a library for the XML Digital Security specification, has been found. Different KeyInfo combinations, like signatures without public key, result in incomplete DSA structures that crash openssl during verification.

This vulnerability does not have a CVE identifier yet.

For Debian 8 Jessie, this problem has been fixed in version 1.7.2-3+deb8u2.

We recommend that you upgrade your xml-security-c packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS