Bug#1144082: box64: mismerge of CVE-2025-13151
Bastien Roucaries <[email protected]>
| Newsgroups | gmane.linux.debian.devel.bugs.rc |
|---|---|
| Message-ID | <1850726.d7IHhHJzqS__5123.45593176491$1786392194$gmane$org@debian-ei> |
Source: box64 Severity: serious Tags: security Justification: security X-Debbugs-Cc: Gajendra Nath Soren <[email protected]>, [email protected] > > CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in > > 4.20.0) > > > > The fix changes: > > char name[2 * ASN1_MAX_NAME_SIZE + 1] > > > > to: > > char name[2 * ASN1_MAX_NAME_SIZE + 2] > > > > This applies to two functions: asn1_expand_any_defined_by and > > asn1_expand_octet_string. > > box64 vendors a private copy of libtasn1 with the same partial-fix pattern: > > asn1_expand_any_defined_by updated, asn1_expand_octet_string still at + 1. Please fix and may be avoid vendoring ? THanks to Gajendra Nath Soren rouca
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmp6LcIACgkQADoaLapB CF96xA/+Mtc/0U57MGrUyJ4HSpzBWnfAm/uwLfF5SNwzOZxz/htDsiq4w3dPdAB3 lqSVUY4PrzHsknEgAJ1/qyi7ZkuqGywhLa9GuakvQgn3/pj07DZO1b8AV4iLLvXv NbJ9TmxMly8hB2AAAbGfH2Oxpat/T7xwC58Y6QpyEkmwV9Bvv67BIGN1XxYWxL6P SO+/Sa3h6KyJACY6bCOfiCIr1Z08e5d5qOvew9sXq16LjbDW9Yq+bIM0fRmCP6F0 RpWw55e5p3rLdmjj30NIvsm9W03/OYDR67TQ+z1igCemr0sVGWnz51wMjQhG638p YuZzQE41a5nNp42xbpItNcNJMH5V1ZVDIaNU/F3h/gH4i7mcE9YCZJhnnoga1I7Y nK5FUjjJ+wam5f2VPdlplpqXPX20uSHcn7HFdmLjr5j91okyfA+nyCbtOkLsZDqv TsDrc2S4WWWTAXn7lPVjRLXJLA5flJmrQkJAm1FBmnWl1bRKYPvSJxrdw3B+KYhs is1Kim239iA8j5olzpT4CPOfBa7geAZw3606uhIujJnrhClcuO5bmQ3urjEVwlBI aNNIL7ahlJur6PXka/uABaIHzQrA7JO1XAQnvNC7hbLIh7I+TRR2K7j8gV6KXeoA X2X+K88B4dvC3eeUjcQLLf7exuBAo8tK1/VPeGbX5uZwDtxomak= =kJX0 -----END PGP SIGNATURE-----