[SECURITY] [DLA 3071-1] libtirpc security update

2022-08-1110:59:36

lists.debian.org

libtirpc

denial of service

debian 10

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.7%

JSON

Debian LTS Advisory DLA-3071-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
August 11, 2022 https://wiki.debian.org/LTS

Package : libtirpc
Version : 1.1.4-0.4+deb10u1
CVE ID : CVE-2021-46828
Debian Bug : 1015873

It was discovered that libtirpc, a transport-independent RPC library,
does not properly handle idle TCP connections. A remote attacker can
take advantage of this flaw to cause a denial of service.

For Debian 10 buster, this problem has been fixed in version
1.1.4-0.4+deb10u1.

We recommend that you upgrade your libtirpc packages.

For the detailed security status of libtirpc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libtirpc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11mips64ellibtirpc-dev< 1.3.1-1+deb11u1libtirpc-dev_1.3.1-1+deb11u1_mips64el.deb
Debian11mips64ellibtirpc3-dbgsym< 1.3.1-1+deb11u1libtirpc3-dbgsym_1.3.1-1+deb11u1_mips64el.deb
Debian10armhflibtirpc-dev< 1.1.4-0.4+deb10u1libtirpc-dev_1.1.4-0.4+deb10u1_armhf.deb
Debian11s390xlibtirpc-dev< 1.3.1-1+deb11u1libtirpc-dev_1.3.1-1+deb11u1_s390x.deb
Debian10armhflibtirpc3-dbgsym< 1.1.4-0.4+deb10u1libtirpc3-dbgsym_1.1.4-0.4+deb10u1_armhf.deb
Debian10amd64libtirpc-dev< 1.1.4-0.4+deb10u1libtirpc-dev_1.1.4-0.4+deb10u1_amd64.deb
Debian11armhflibtirpc3-udeb< 1.3.1-1+deb11u1libtirpc3-udeb_1.3.1-1+deb11u1_armhf.deb
Debian11i386libtirpc-dev< 1.3.1-1+deb11u1libtirpc-dev_1.3.1-1+deb11u1_i386.deb
Debian10arm64libtirpc3-dbgsym< 1.1.4-0.4+deb10u1libtirpc3-dbgsym_1.1.4-0.4+deb10u1_arm64.deb
Debian10arm64libtirpc3< 1.1.4-0.4+deb10u1libtirpc3_1.1.4-0.4+deb10u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mips64el	libtirpc-dev	< 1.3.1-1+deb11u1	libtirpc-dev_1.3.1-1+deb11u1_mips64el.deb
Debian	11	mips64el	libtirpc3-dbgsym	< 1.3.1-1+deb11u1	libtirpc3-dbgsym_1.3.1-1+deb11u1_mips64el.deb
Debian	10	armhf	libtirpc-dev	< 1.1.4-0.4+deb10u1	libtirpc-dev_1.1.4-0.4+deb10u1_armhf.deb
Debian	11	s390x	libtirpc-dev	< 1.3.1-1+deb11u1	libtirpc-dev_1.3.1-1+deb11u1_s390x.deb
Debian	10	armhf	libtirpc3-dbgsym	< 1.1.4-0.4+deb10u1	libtirpc3-dbgsym_1.1.4-0.4+deb10u1_armhf.deb
Debian	10	amd64	libtirpc-dev	< 1.1.4-0.4+deb10u1	libtirpc-dev_1.1.4-0.4+deb10u1_amd64.deb
Debian	11	armhf	libtirpc3-udeb	< 1.3.1-1+deb11u1	libtirpc3-udeb_1.3.1-1+deb11u1_armhf.deb
Debian	11	i386	libtirpc-dev	< 1.3.1-1+deb11u1	libtirpc-dev_1.3.1-1+deb11u1_i386.deb
Debian	10	arm64	libtirpc3-dbgsym	< 1.1.4-0.4+deb10u1	libtirpc3-dbgsym_1.1.4-0.4+deb10u1_arm64.deb
Debian	10	arm64	libtirpc3	< 1.1.4-0.4+deb10u1	libtirpc3_1.1.4-0.4+deb10u1_arm64.deb