[818490] synergy: uses broken crypto

[epakai]

BTS_msg_id: 20160317152438.9666.54690.reportbug@bos-lp47r.kendall.corp.akamai.com BTS author: Daniel Cooper outlandishlizard@gmail.com

Package: synergy Severity: normal

Dear Maintainer,

Versions of synergy before 1.7 use trivially broken cryptography-- and it does not appear that the version in debian has taken any patches to resolve this. Please update to at least 1.7, or backport the patch adding SSL support.

-- System Information: Debian Release: jessie/sid APT prefers trusty-updates APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty') Architecture: amd64 (x86_64) Foreign Architectures: i386

Kernel: Linux 3.13.0-79-generic (SMP w/4 CPU cores) Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Shell: /bin/sh linked to /bin/dash

[epakai]

BTS_msg_id: E1cb2r4-000C1k-8a@fasolo.debian.org BTS author: Joshua Honeycutt joshua.honeycutt@gmail.com

Source: synergy Source-Version: 1.8.7-stable+dfsg.1-1

We believe that the bug you reported is fixed in the latest version of synergy, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is attached.

Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 818490@bugs.debian.org, and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software pp. Joshua Honeycutt joshua.honeycutt@gmail.com (supplier of updated synergy package)

(This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Format: 1.8 Date: Mon, 06 Feb 2017 09:25:39 -0600 Source: synergy Binary: synergy Architecture: source Version: 1.8.7-stable+dfsg.1-1 Distribution: experimental Urgency: medium Maintainer: Joshua Honeycutt joshua.honeycutt@gmail.com Changed-By: Joshua Honeycutt joshua.honeycutt@gmail.com Description: synergy - Share mouse, keyboard and clipboard over the network Closes: 764390 818490 852081 Changes: synergy (1.8.7-stable+dfsg.1-1) experimental; urgency=medium .

• New maintainer (Closes: #852081)
• New upstream version. (Closes: #764390, #818490)
• Update watchfile to check symless github.
• Upstream tarball modified to remove non-DFSG files and unused external library tarballs.
• Removed patches: cprotocolutil-writef, system-cryptopp, x11-mouseover.
• Added shell script to generate SSL key/certificate files for encryption (/usr/share/synergy/gen_ssl_pem.sh).
• Updated man pages (removed old crypto++ references and command line options, added new command line options, formatting).
• Added documentation to README.Debian on enabling crypto without the gui.
• Added new_ssl patch to build against newer OpenSSL in Debian.
• Added enable_pro patch to bypass activation for Pro features.
• Added syntool binary and manual page.
• lintian override for possible-gpl-code-linked-with-openssl due to upstream exception.
• Added a debian specific version string to the GUI about dialog. Checksums-Sha1: e79d2c0de0f63d1a3f1a0dba1e661eca8f2abe3a 2106 synergy_1.8.7-stable+dfsg.1-1.dsc bee814830174accd3725778eca32f2044746b5c6 1708791 synergy_1.8.7-stable+dfsg.1.orig.tar.gz f63323035ad0aa367fda3de2a6a887998c301826 20952 synergy_1.8.7-stable+dfsg.1-1.debian.tar.xz Checksums-Sha256: 3d94fcb6d9b2a6a241c3328902c23d8d8ee7fb7bbe4b50efb7870b6006207e2a 2106 synergy_1.8.7-stable+dfsg.1-1.dsc 8eaae5c0893b0a88f7a885b994233bfc8b10c177e6f4f5b33c766e6eafa34367 1708791 synergy_1.8.7-stable+dfsg.1.orig.tar.gz 0c12e3a075434e6947a4907d83cfde527539a7c34ad61fa49b00a7910398ae69 20952 synergy_1.8.7-stable+dfsg.1-1.debian.tar.xz Files: 02abab44956de5bbfd55f16e7703c1be 2106 x11 optional synergy_1.8.7-stable+dfsg.1-1.dsc 9c2d9ad9d10367bbc3f3bcfc6d2d1bbe 1708791 x11 optional synergy_1.8.7-stable+dfsg.1.orig.tar.gz f1328885bac4de0e8e031d9344cf6368 20952 x11 optional synergy_1.8.7-stable+dfsg.1-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3ZhhqyPcMzOJLgepaOcTmB0VFfgFAliZmXYACgkQaOcTmB0V Ffji2A/9G8jad9ErpDm/d/3s9S8LQpUF+yQuYszq1EGucH9gyj3Jc2SYmSo7c3pL YEf/JNUcxGQ6ttS3adLM6k0ROR5lO3hv1YT9gkDfzWnXLvQ+y1ZpdjxJ6C+1/Tul 8W1L3EUJGliu8FOfc3OdXpK1NI0iWGI2jW47wHb2LtktG/S4zllYG9x8UmpQwIcy ZadnB+uinen0ekIq2gjUTl/EOI61yATbAkbXfA7Rw/kBc2gaUHr/1qkQ9o8XNZXL dPTaZiplUHBeQRc2KJNvjeG7hp+RU+p8cNBDaQrBstSFsaeD4EkV4dCgplsqLbxE l1R/nIiQxm9UpkdWk44fQ9nkJ7zMtl0JEipTwj2HPuJq/xY03NWTE1pMEumBa/EM JqNYdwVaNnxiwVguYbjYlRsa+6/cMIfEjKQX1NcbinuJtH63yu+2PjFyXitl6agD wWjPBWC26sB3o1BjxZH1wrGfEFZMz/TC95jVcVfly/HpjH3e27sqolmIaRdSqKHr 5tY4UXF0rEu9VOnUNkrOR/m3Uywa9eQIlWM0WoB/VLmhjWzWcC3BXAvXcPORNRc6 P8Qj2jhBOiLZQ7uwGqs10bOTxsKvGl3iQNJn32Nk+01WLc6OZQXK47y4dphZXvJb pBa+RcnxI3LLoVjfWhggZ74k17kmX2kp9FZnSVZ+T6uE1FntTqk= =BB6u -----END PGP SIGNATURE-----