-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 11 Jan 2017 18:16:53 +0000
Source: ikiwiki
Binary: ikiwiki
Architecture: all source
Version: 3.20170111
Distribution: unstable
Urgency: high
Maintainer: Simon McVittie <smcv@debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
ikiwiki - wiki compiler
Changes:
ikiwiki (3.20170111) unstable; urgency=high
.
* passwordauth: prevent authentication bypass via multiple name
parameters (CVE-2017-0356, OVE-20170111-0001)
* passwordauth: avoid userinfo forgery via repeated email parameter
(also in the scope of CVE-2017-0356)
* CGI, attachment, passwordauth: harden against repeated parameters
(not believed to have been a vulnerability)
* remove: make it clearer that repeated page parameter is OK here
* t/passwordauth.t: new automated test for passwordauth
Checksums-Sha1:
2665446554d805d567cd34e5577dd663d1da167b 2215 ikiwiki_3.20170111.dsc
c6df014617d3ac5e6c57eb573f02cc4cf71e9b7b 2614240 ikiwiki_3.20170111.tar.xz
8be59f68360db55984a5b944e665276f1296c348 10571 ikiwiki_3.20170111_all.buildinfo
f34090a60de30978b90db22dde79f97ba66263c0 1413470 ikiwiki_3.20170111_all.deb
Checksums-Sha256:
845037bad96326d32eaa6cc0ca3741afafee07fc8d825abe419511e862c1789f 2215 ikiwiki_3.20170111.dsc
5f0f99a4f4a5f17046e4601d628424cb2877766b4ef9bfe1c2db1941f6f7a701 2614240 ikiwiki_3.20170111.tar.xz
577ccf85b1d7f168d8ce584ade7208861ddcbb223b2e5687d0f14029dad9aeb9 10571 ikiwiki_3.20170111_all.buildinfo
a07b4e9f55c872dedcfd14f5eb9ce7d74ca1d6f656a3683679c3778c8a692eb9 1413470 ikiwiki_3.20170111_all.deb
Files:
3eda1a817a52bc08d08fcaf26c383a4a 2215 web optional ikiwiki_3.20170111.dsc
7902fc11654896014dae9d80d954bea8 2614240 web optional ikiwiki_3.20170111.tar.xz
a13973ec895932d0384876cf16cbe63c 10571 web optional ikiwiki_3.20170111_all.buildinfo
a142dbcf66e218693c0658101078ec1e 1413470 web optional ikiwiki_3.20170111_all.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAlh2gFYACgkQTej/KmPH
zJA24Q/6A3hqxAs5Wz0SlfDRhGpy7CTjBvqQ9NPnVih2qIjBrcTKFPDQjtd5GzLq
qWk9SrobowTrcthE7Sp20yqzu/r5jsTqdGyBk9bqHQQtTgwtlzjYqO/NQFrXVrVb
n3UC8zBdTgQHQ8MczHR7LPAAAxrEu7sPs5b0ZdRB9a6giCNJkrGVqseNE212bw6p
I9fWcpugcmVs9u6Yt4j/VBPzKkklydVTzxsItWOHBpJJYm6AmsCk//H3Rf0/66b8
2mKvoHIRkERKvTAskYCb856y0qa/xtSYjGp89cvMWOGxsFwB7DyXT8j0YN81JX1A
TuvEMihLTXl1RiMhW+MPjpEXbugRPZfxkIkp/DiaZK21DMeIwdDx4mE4SHg6qBrJ
/dY9gmDoynFD0sQWL3+hQtKwBKqSqzLzS0dtCLebXmUvv3vViGUykibsmmEgKZp6
Y+xNfb+BCxrd/0928ztAbCZBl6kmD8/5ZRRTJ+2A2NSn/KUUbiTcy6uJWNpIBRjg
ZhRNzmdqnIALaxMb+LMn8rqgI7C5N+CGtrYliAKyVfA+fW/esgTrXg5z4CmSmbzW
wWI8VCx5M4xYrDxgYkkcOxWmhLgLokeHIaAEG5zH7s4x/QH139T4KFKb+9yBUT4J
9CR6mrAVHeqmTukxLXWvA4eZCblZl/iXsqvjjio7QcvOp3yspt8=
=aTOQ
-----END PGP SIGNATURE-----