USN-4306-1 — dino-im vulnerabilities

Summary

It was discovered that Dino incorrectly validated inputs. An attacker could use
this issue to possibly obtain, inject or remove sensitive information.

This update also includes a fix to the encryption implementation in Dino to
support 12 byte IVs, in addition to 16 byte IVs.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	dino-im	0.0.git20180130-1ubuntu0.1

Vulnerabilities 3

Unscored —

CVE-2019-16235

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

dino-im dino-im Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16236

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

dino-im dino-im Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16237

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_manageme…

dino-im dino-im Debian Ubuntu

Sep 11, 2019

References

report
https://ubuntu.com/security/CVE-2019-16235
report
https://ubuntu.com/security/CVE-2019-16236
report
https://ubuntu.com/security/CVE-2019-16237
report
https://bugs.launchpad.net/bugs/1866115

dino-im vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 3

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_manageme…

References