Debian Security Advisory
DLA-1594-1 xml-security-c -- LTS security update
- Date Reported:
- 24 Nov 2018
- Affected Packages:
- Security database references:
- No other external database security references currently available.
- More information:
A vulnerability in xml-security-c, a library for the XML Digital Security specification, has been found. Different KeyInfo combinations, like signatures without public key, result in incomplete DSA structures that crash openssl during verification.
This vulnerability does not have a CVE identifier yet.
For Debian 8
Jessie, this problem has been fixed in version 1.7.2-3+deb8u2.
We recommend that you upgrade your xml-security-c packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS