Subject: [bug#48656] [PATCH] gnu: lz4: Add a patch for CVE-2021-3520.

From: Jelle Licht <[email-masked]>
Date: Mon, 29 May 2023 13:31:12 +0200

Leo Famulari <[email-masked]> writes:

> On Tue, May 25, 2021 at 03:07:05PM -0400, Leo Famulari wrote:
>> Is there any discussion about this upstream? Why isn't it included in
>> lz4 yet?
>
> I found approval from the lz4 maintainers:
>
> https://github.com/lz4/lz4/pull/972#issuecomment-830192743
> https://github.com/lz4/lz4/pull/972#issuecomment-799719118

It seems there's some uncertainty w.r.t. the validity of the CVE [0],
but since then a release has been made that pulls the changes discussed
in issue 972 into lz4 release 1.9.4.