CVE-2017-17066

Name	CVE-2017-17066
Description	The (1) i2pd before 2.17 and (2) kovri pre-alpha implementations of the I2P routing protocol do not properly handle Garlic DeliveryTypeTunnel packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading sensitive router memory, aka the GarlicRust bug.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
i2pd (PTS)	buster	2.23.0-1	fixed
	bullseye	2.36.0-1	fixed
	bookworm	2.45.1-1	fixed
	sid	2.51.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
i2pd	source	(unstable)	(not affected)

- i2pd <not-affected> (Fixed before/with the initial upload to Debian)
Issue fixed with 2.17.0 upstream