[SECURITY] [DLA 1818-1] dbus security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : dbus
Version : 1.8.22-0+deb8u2
CVE ID : CVE-2019-12749
Debian Bug : 930375
Joe Vennix discovered an authentication bypass vulnerability in dbus, an
asynchronous inter-process communication system. The implementation of
the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a
symbolic link attack. A local attacker could take advantage of this flaw
to bypass authentication and connect to a DBusServer with elevated
privileges.
For Debian 8 "Jessie", this problem has been fixed in version
1.8.22-0+deb8u2.
We recommend that you upgrade your dbus packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAl0DiwIACgkQnUbEiOQ2
gwLZDxAAtmfjDVtOAytK5QN6A1CsnufwNzBDnBNVlKqpig04LsU6+x+qCQG7BlJ0
cgpjsAvnlXbV6+JJivzm75KVbVhOqKB5A1EjNB77F7clrPSkiMipPYntn8NzweE3
Q+n+7ICF6cYm/DAY1aRxzdJyUW/syD/cuFWgHoEdkyksXKF0nDqQsXzK0YW+W9o3
nkJiwFrfKmxfXPJf07PupUv/XeRONBds72jQE+RcAgdHTebr34+W5TvD1p9nCq2e
tl1O6tyW/K7Rs4HJKVQVxPk7mRLfhPdJh85eef0m44KVsfHEhQRykKJ+0gCROlp+
44AUb5PBJVoSwEM1UpcKsxFVuCmGZ1WL7TQl4z/T1b56CjOfnYp1++jRFoIrP5Ic
evsHBm7fwN7Ogtu4TCgFKiekIx4ByoUcwcE958hn9gBlnYUv/wPA4/6zdgVQsxGA
utvYGByDwJr3odAwUp9Gzq1XHH0++CrPoxye3F8811lspwE8LVSGDe8dBGVr3lJx
AakIKBrn21oxeTUUZlOOUOhD5sIccbiTXN3xPWUN0unTlOdY17D69Sp4wSMpHRDY
UYPxppFT5F4L1dgbO2Q4aaMANJxuEXRFuRG9i+zOmkVvaEk/TV7AgeMioqpwhfZj
gjSWwqpJM1LefW6+ceg4rQgL+Nk71mtCOTkeBlPzsxQdp8TpGYk=
=7qgA
-----END PGP SIGNATURE-----
Reply to: