#47510 cflow is vulnerable to CVE-2019-16165 and CVE-2019-16166

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Léo Le Bouter <lle-bout@zaclys.net>

To: bug-guix@gnu.org

Subject: cflow is vulnerable to CVE-2019-16165 and CVE-2019-16166

Date: Wed, 31 Mar 2021 03:50:22 +0200

[Message part 1 (text/plain, inline)]

I asked the maintainer to fix the issues because they were unfixed
since a while, they have done so recently:

https://git.savannah.gnu.org/cgit/cflow.git/commit/?id=b9a7cd5e9d4efb54141dd0d11c319bb97a4600c6

They have not made a recently, also it seems they fixed other issues
that could be security relevant in their commit log, not sure if we
apply/backport patches or wait for release.

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 47510-done@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>

To: Léo Le Bouter <lle-bout@zaclys.net>

Cc: 47510-done@debbugs.gnu.org

Subject: Re: bug#47510: cflow is vulnerable to CVE-2019-16165 and CVE-2019-16166

Date: Thu, 17 Mar 2022 22:35:12 -0400

Hello!

Léo Le Bouter <lle-bout@zaclys.net> writes:

> I asked the maintainer to fix the issues because they were unfixed
> since a while, they have done so recently:
>
> https://git.savannah.gnu.org/cgit/cflow.git/commit/?id=b9a7cd5e9d4efb54141dd0d11c319bb97a4600c6
>
> They have not made a recently, also it seems they fixed other issues
> that could be security relevant in their commit log, not sure if we
> apply/backport patches or wait for release.

Our cflow package is now at 1.7, which includes the above commit and CVE
fixes.

Thank you,

Maxim

Send a report that this bug log contains spam.