GNU bug report logs - #70174
OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Vinicius Monego <monego <at> posteo.net>
Subject: bug#70174: closed (Re: bug#70174: OpenEXR is vulnerable to
 CVE-2023-5841 and CVE-2021-45942)
Date: Thu, 18 Apr 2024 05:00:05 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#70174: OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 70174 <at> debbugs.gnu.org.

-- 
70174: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=70174
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: John Kehayias <john.kehayias <at> protonmail.com>
To: Vinicius Monego <monego <at> posteo.net>
Cc: 70174-done <at> debbugs.gnu.org
Subject: Re: bug#70174: OpenEXR is vulnerable to CVE-2023-5841 and
 CVE-2021-45942
Date: Thu, 18 Apr 2024 04:58:37 +0000

On Thu, Apr 04, 2024 at 03:47 AM, John Kehayias wrote:

> On Thu, Apr 04, 2024 at 02:50 AM, John Kehayias wrote:
>
>> Hello,
>>
>> On Thu, Apr 04, 2024 at 01:07 AM, Vinicius Monego wrote:
>>
>>> OpenEXR suffers from these vulnerabilities which were fixed in version
>>> 3.2.2 [1] and 3.1.4 [2], respectively, while our version is currently
>>> 3.1.3.
>>>
>>> The package contains 448 dependents, and a change in derivation
>>> shouldn't be pushed to master, at least according to the patch
>>> submission guidelines.
>>>
>>> [1] https://nvd.nist.gov/vuln/detail/CVE-2023-5841
>>>
>>> [2] https://nvd.nist.gov/vuln/detail/CVE-2021-45942
>>
>> Thanks for passing this along.
>>
>> I've applied a patch, attached, locally to the mesa-updates branch which
>>  updates openexr to the latest version, 3.2.4. It required a few minor
>>  changes (fix a phase, an input) but it builds.
>>
>> I may wait to queue up some more fixes for that branch, but don't
>> currently have anything pending. Either way, it will be there soon and
>> hopefully merged to master (just need to wait for everything to build
>> and look good).
>>
>> Thanks!
>> John
>
> Forgot to note the change in [inputs] in the changelog, fixed locally.

Pushed as 410e699e0933653e69d03a4cdadf11854c6723f4 (and fixed some build
issues with 2718616f77aace28b3962fef29b4e38b87a512ce) and merged with
2d5736cc3e869fadd2592cc13a8d332fac63b144.

Thanks!
John

[Message part 3 (message/rfc822, inline)]

From: Vinicius Monego <monego <at> posteo.net>
To: bug-guix <at> gnu.org
Subject: OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942
Date: Thu,  4 Apr 2024 01:07:52 +0000

OpenEXR suffers from these vulnerabilities which were fixed in version 
3.2.2 [1] and 3.1.4 [2], respectively, while our version is currently 3.1.3.

The package contains 448 dependents, and a change in derivation 
shouldn't be pushed to master, at least according to the patch 
submission guidelines.

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-5841

[2] https://nvd.nist.gov/vuln/detail/CVE-2021-45942

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.