Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update: ncurses #1045

Closed
vbatts opened this issue May 25, 2023 · 0 comments · Fixed by flatcar/scripts#963
Closed

update: ncurses #1045

vbatts opened this issue May 25, 2023 · 0 comments · Fixed by flatcar/scripts#963
Labels
advisory/upstream-blocked blocked by upstream projects advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns

Comments

@vbatts
Copy link
Member

vbatts commented May 25, 2023 •
edited by dongsupark
Loading

Name: ncurses
CVEs: CVE-2023-29491
CVSSs: 7.8
Action Needed: update to >= 6.4_20230418

Summary: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

We need to have >= 6.4_20230418 because of a regression in 6.4_20230408. Due to that, especially in openrc, ncurses released snapshots _p20230415, _p20230418 and _p20230424. At least _p20230418 is known to fix the regresssions. However, Gentoo still masks all the snapshot versions.

refmap.gentoo: https://bugs.gentoo.org/904247
@vbatts vbatts added advisory security advisory security security concerns labels May 25, 2023
@dongsupark dongsupark moved this from 📝 Needs Triage to 🪵Backlog in Flatcar tactical, release planning, and roadmap May 25, 2023
@dongsupark dongsupark added cvss/HIGH > 7 && < 9 assessed CVSS advisory/upstream-blocked blocked by upstream projects labels May 25, 2023
@krnowak krnowak mentioned this issue Jul 5, 2023
Merged
2 tasks
@github-actions github-actions bot mentioned this issue Nov 10, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
advisory/upstream-blocked blocked by upstream projects advisory security advisory cvss/HIGH > 7 && < 9 assessed CVSS security security concerns
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Weekly portage-stable package updates 2023-07-03 flatcar/scripts
2 participants
@vbatts @dongsupark