Unfixed security issues CVE-2018-16758, CVE-2018-16738

[Jan Hülsbergen]

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16758

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16738

Fixed in Debian as of September 22nd. http://metadata.ftp-master.debian.org/changelogs//main/t/tinc/tinc_1.0.31-1+deb9u1_changelog

And upstream in version 1.0.35

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[t-m-w (t-m-w)]

Does Ubuntu have the ability to remove unmaintained and vulnerable community packages? If so, please remove tinc, as it looks like in several months, fixes present in Debian have not made their way here, putting users at unnecessary risk.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.