-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 11 Jul 2024 10:16:11 +0000
Source: php-cas
Architecture: source
Version: 1.3.8-1+deb11u1
Distribution: bullseye
Urgency: medium
Maintainer: Xavier Guimard <yadd@debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1023571
Changes:
 php-cas (1.3.8-1+deb11u1) bullseye; urgency=medium
 .
   * Security upload
   * Fix CVE-2022-39369: The phpCAS library uses HTTP headers
     to determine the service URL used to validate tickets.
     This allows an attacker to control the host header
     and use a valid ticket granted for any authorized service in the same
     SSO realm (CAS server) to authenticate to the service protected by
     phpCAS.  Depending on the settings of the CAS server service registry in
     worst case this may be any other service URL (if the allowed URLs are
     configured to "^(https)://.*") or may be strictly limited to known and
     authorized services in the same SSO federation if proper URL service
     validation is applied.
     The fix for this vulnerabilty requires an API breaking change
     in php-cas and will require that software using the library be updated.
     (Closes: #1023571)
Checksums-Sha1:
 4a00d8a7cd056abcbe8e88cc1eec5aea4c6e5fea 1908 php-cas_1.3.8-1+deb11u1.dsc
 a1083b8ec02c4f43ba8aaee2b696fafff8c1e567 68707 php-cas_1.3.8.orig.tar.gz
 d3fec4fb45058eb9d024889abf660cad0212f7c2 10704 php-cas_1.3.8-1+deb11u1.debian.tar.xz
 3ecbec2239b14f3517cbaaf4c6f5170355414401 6752 php-cas_1.3.8-1+deb11u1_amd64.buildinfo
Checksums-Sha256:
 6a437287439434ffd7f792286d2ba0e417b5e11c885caac416c88b516c500f07 1908 php-cas_1.3.8-1+deb11u1.dsc
 aa7e7b9d1a4627ccede66a76ba22391654ef2288724769de0a9a37b47a4b50e1 68707 php-cas_1.3.8.orig.tar.gz
 8411e15bc38b5151f2bb6402c8f2b8a9a85db2258ef5b54be0ecfd0ea4ff050e 10704 php-cas_1.3.8-1+deb11u1.debian.tar.xz
 ae1682e0d4e9dfb2c9a0a3a03df02a56a1a22e6737ab68ca31901b9448ec765e 6752 php-cas_1.3.8-1+deb11u1_amd64.buildinfo
Files:
 c4dac589a1013c303a3bdfb03340fa06 1908 php optional php-cas_1.3.8-1+deb11u1.dsc
 94b4a0172d898c11bcb7ada8e33442f7 68707 php optional php-cas_1.3.8.orig.tar.gz
 8f8ef1d6a9cbc5120a111c02b85318f2 10704 php optional php-cas_1.3.8-1+deb11u1.debian.tar.xz
 6df8b0bcd289d89120b9b63f2f75707c 6752 php optional php-cas_1.3.8-1+deb11u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAma9HGERHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF8B+A//Uy1bRV9m53itkkRSiPAlqZi6o6iRDr2I
liVsrr2brP+X/HSGJzWJFccQ7IkvsaZD7tI9trkX7maYRseHzSgAKSaoIfJgpCtI
Wq6j2So7U1mMSakxBlEc5Bf+mVRZufrzfWjGXHFiLLCeGVPaVsrPkGTgmb7/B+c3
EYBeoqGyq10tDakC6b2jH8OM/FtnoeTWKykVk44RSwyQTCFBwA/yG7dNOH1owUeC
qGgzB0C0/6xc01Vc0/Lk9MxF2Y+ibXsBGOhjWMZ+5yKjjbEBuPU42lp4so1ioUD3
RIWEj0xMhPUXwFbRfRJdcTig2ISxOyg2clKHcqqvxs8dydkg+zN1NSE4L8bLBcnJ
08rjdDfZqpyOB5a6W6hEiXfy9i+GCUk+/E2BltQ71kIehJXA0zixqqE5Wgf62xqx
DvxzFQFoKSX3wdQyszxDXleUUxZhPN7w5TlOBBCY+txFMXtG+okEh8si+9otF9Z0
/IdQw76gEs/f0sInCoe3/sk+k3DRuL1jkFfUWl4Li+B1l7qTJdcRC/3ntYSAfjqe
VPDQXzjC8JhJ3eVfUvztL9b+8E0zdhsMDE7WkUS+Rj+Ec0fTZOCz8ydGUC6S11AE
YxXqH4ssHhCp7pa8OlbNANlW/IDmFUjD+saMr5jfbgSyksul5AY7EQmIesX9jwvr
zccibxduPn8=
=L3PQ
-----END PGP SIGNATURE-----