[pkg-dhcp-devel] Bug#887413: isc-dhcp: CVE-2017-3144: dhcp: omapi code doesn't free socket descriptors when empty message is received allowing denial-of-service

[Salvatore Bonaccorso]

Source: isc-dhcp
Version: 4.3.1-6
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for isc-dhcp.

CVE-2017-3144[0]:
|dhcp: omapi code doesn't free socket descriptors when empty message is
|received allowing denial-of-service

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-3144
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3144
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1522918
[2] https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commit;h=1a6b62fe17a42b00fa234d06b6dfde3d03451894

Regards,
Salvatore