GNU bug report logs - #70174
OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942

Previous Next

Package: guix;

Reported by: Vinicius Monego <monego <at> posteo.net>

Date: Thu, 4 Apr 2024 01:09:03 UTC

Severity: normal

Done: John Kehayias <john.kehayias <at> protonmail.com>

Bug is archived. No further changes may be made.

Full log

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Vinicius Monego <monego <at> posteo.net>
To: bug-guix <at> gnu.org
Subject: OpenEXR is vulnerable to CVE-2023-5841 and CVE-2021-45942
Date: Thu,  4 Apr 2024 01:07:52 +0000

OpenEXR suffers from these vulnerabilities which were fixed in version 
3.2.2 [1] and 3.1.4 [2], respectively, while our version is currently 3.1.3.

The package contains 448 dependents, and a change in derivation 
shouldn't be pushed to master, at least according to the patch 
submission guidelines.

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-5841

[2] https://nvd.nist.gov/vuln/detail/CVE-2021-45942
This bug report was last modified 1 year and 112 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.