|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2020-23910: asn1c: stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c. | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Thomas Leroy <thomas.leroy> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | msuchanek, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/372804/ | ||
| Whiteboard: | |||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Thomas Leroy
2023-07-19 07:18:41 UTC
No fix upstream yet. Affected: - SUSE:SLE-15:Update - openSUSE:Factory SLE is unaffected, we don't ship asn1c, only code generated by asn1c AFAIK. Also generally problems from compiling untrusted code cannot be considered very serious vulnerability. python3-asn1crypto Basesystem Module (sle-module-basesystem/15.4/x86_64) SUSEConnect --product sle-module-basesystem/15.4/x86_64 libasn1c-devel SUSE Package Hub (PackageHub/15.4/x86_64) SUSEConnect --product PackageHub/15.4/x86_64 libasn1c1 SUSE Package Hub (PackageHub/15.4/x86_64) SUSEConnect --product PackageHub/15.4/x86_64 asn1c SUSE Package Hub (PackageHub/15.4/x86_64) SUSEConnect --product PackageHub/15.4/x86_64 python3-asn1crypto Installed python3-asn1crypto Available in repo Basesystem_Module_15_SP4_x86_64:SLE-Module-Basesystem15-SP4-Pool It was reported almost 3 years ago and nothing was done about it upstream. I don't see anything happening on our side as realistic other than acknowledging that the problem exists. It does not have severity assigned either after 3 years so if anything it's a candidate for dispute. (In reply to Michal Suchanek from comment #2) > SLE is unaffected, we don't ship asn1c, only code generated by asn1c AFAIK. Indeed, thanks for pointing. Let's just close it done |