GNU bug report logs - #70174
OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942

Previous Next

Full log

Message #11 received at 70174 <at> debbugs.gnu.org (full text, mbox):

From: John Kehayias <john.kehayias <at> protonmail.com>
To: Vinicius Monego <monego <at> posteo.net>
Cc: 70174 <at> debbugs.gnu.org
Subject: Re: bug#70174: OpenEXR is vulnerable to CVE-2023-5841 and
 CVE-2021-45942
Date: Thu, 04 Apr 2024 03:47:37 +0000

On Thu, Apr 04, 2024 at 02:50 AM, John Kehayias wrote:

> Hello,
>
> On Thu, Apr 04, 2024 at 01:07 AM, Vinicius Monego wrote:
>
>> OpenEXR suffers from these vulnerabilities which were fixed in version
>> 3.2.2 [1] and 3.1.4 [2], respectively, while our version is currently
>> 3.1.3.
>>
>> The package contains 448 dependents, and a change in derivation
>> shouldn't be pushed to master, at least according to the patch
>> submission guidelines.
>>
>> [1] https://nvd.nist.gov/vuln/detail/CVE-2023-5841
>>
>> [2] https://nvd.nist.gov/vuln/detail/CVE-2021-45942
>
> Thanks for passing this along.
>
> I've applied a patch, attached, locally to the mesa-updates branch which
>  updates openexr to the latest version, 3.2.4. It required a few minor
>  changes (fix a phase, an input) but it builds.
>
> I may wait to queue up some more fixes for that branch, but don't
> currently have anything pending. Either way, it will be there soon and
> hopefully merged to master (just need to wait for everything to build
> and look good).
>
> Thanks!
> John

Forgot to note the change in [inputs] in the changelog, fixed locally.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.