Tinc VPN security issue (CVE-2013-1428)

[Fleg]

Please update ubuntu with a newer version of tinc because of the vulnerability below.

http://www.tinc-vpn.org/pipermail/tinc/2013-April/003240.html

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Malte S. Stretz (mss)]

Does this help? http://launchpadlibrarian.net/138627199/tinc_1.0.19-2_1.0.19-3.diff.gz

[Renne (renne)]

Ubuntu 12.04.2 LTS is using Tinc 1.0.16.
Ubuntu 13.04.2 is using Tinc 1.0.19.

So I suggest to upgrade Ubuntu 12.04.2 LTS and 13.04 to Tinc version 1.0.21.

[Renne (renne)]

Guus Sliepen, the main developer of Tinc, said the patch can be adjusted to 1.0.16 fot LTS, too. Depending on the update policy of Ubuntu an update to 1.0.21 provides the option "Name = $HOST" in the configuration file, which would simplify deploying of multiple nodes a lot. For Current releases he recommended to update to 1.0.21.

[Launchpad Janitor (janitor)]

[Expired for tinc (Ubuntu) because there has been no activity for 60 days.]

[Avery-yates (avery-yates)]

This is still an issue. LTS needs a backport. Some of us are in this boat until 2017.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release