<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Good evening Mr. Wagner,<br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Thank you very much.<br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
We have not validated a scenario like you mention. Our use cases, related to this XML signature generation, are not susceptible to exploit such vulnerability; but I think it could be possible in other use cases. In our use case, we experience inestability of
the system due to an unpredictable segmentation fault in the library.<br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Thanks,<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Alejandro.<br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Get <a href="https://aka.ms/ghei36">Outlook for Android</a></div>
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Ferenc Wagner,,, <wferi@niif.hu> on behalf of wferi@niif.hu <wferi@niif.hu><br>
<b>Sent:</b> Sunday, February 24, 2019 2:17:03 PM<br>
<b>To:</b> Alejandro Claro Mosqueda<br>
<b>Cc:</b> 922984@bugs.debian.org<br>
<b>Subject:</b> Re: Bug#922984: xml-security-c: ECDSA XML signature generation segmentation fault</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">Alejandro Claro <alejandro.claro@smartmatic.com> writes:<br>
<br>
> We found a bug in Apache Santuario C, related to ECDSA signature<br>
> generation, few years ego. We provide the fix to the Apache team, and<br>
> Scott Cantor kindly accepted the fix in the project. How ever the fix<br>
> was introduced in series 2.x of the the library.<br>
<br>
Dear Alejandro,<br>
<br>
I can propose your fix for the next stable update, but I don't know when<br>
that will be released. On the other hand, if this buffer overflow leads<br>
to an exploitable vulnerability, the Security Team could fast-track the<br>
fix. Have you got such a scenario?<br>
-- <br>
Thanks,<br>
Feri<br>
</div>
</span></font>
</body>
</html>