All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: nvd <nvd@nist.gov>
Cc: "buildroot@buildroot.org" <buildroot@buildroot.org>
Subject: [Buildroot] CVE-2024-7592 version range fix
Date: Tue, 31 Dec 2024 12:07:58 +0100	[thread overview]
Message-ID: <20241231120758.3e2858c5@windsurf> (raw)

Dear NVD maintainers,

CVE-2024-7592 reported against Python is documented at
https://nvd.nist.gov/vuln/detail/CVE-2024-7592 as affecting
all versions of Python prior to 3.12.5.

First of all, the entry is incorrect because the fix was merged for
3.12.6 and not 3.12.5, so in the 3.12.x branch, only >= 3.12.6 have the
fix. The fix is commit
https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1,
which git clearly states was only merged in 3.12.6:

$ git tag --contains dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1
v3.12.6
v3.12.7
v3.12.8

In addition to that, the fix has been backported to the 3.9.x, 3.10.x
and 3.11.x maintenance branches, so some versions numerically lower
than 3.12.6 have the fix.

Namely:

* https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f
  was merged in 3.11.10, so all 3.11.x versions >= 3.11.10 are not affected

* https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a
  was merged in 3.10.15, so all 3.10.x versions >= 3.10.15 are not affected

* https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774
  was merged in 3.9.20, so all 3.9.x versions >= 3.9.20 are not affected

See also
https://security-tracker.debian.org/tracker/CVE-2024-7592 for a good recap
on this.

Would it be possible to fix the NVD entry for CVE-2024-7592 to take
into account those extra details?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

                 reply	other threads:[~2024-12-31 11:08 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241231120758.3e2858c5@windsurf \
    --to=buildroot@buildroot.org \
    --cc=nvd@nist.gov \
    --cc=thomas.petazzoni@bootlin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.