Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-07-07 Thread Craig Small
On Wed, 8 Jul 2020 at 01:48, Sylvain Beucler wrote: > On 07/07/2020 17:07, Sylvain Beucler wrote: > > In any case, all of this happens between 5.7.3 and 5.8.pre1. > > Restricting further (good..bad): > > $ git shortlog > >

Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-07-06 Thread Sylvain Beucler
Hi, Do we have definite info on what versions are affected? I cannot reproduce the issue in jessie/stretch/buster (5.7.x). Incidentally Salvatore's test now yields an error in bullseye (5.8dfsg-3), though I suspect the issue is at the client's level: # snmpbulkget -v3 -Cn1 -Cr1472 -l authPriv

Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-07-06 Thread Sergio Durigan Junior
On Monday, June 29 2020, Craig Small wrote: > Hi All > There's a few goes of the required patches but I think I've got them all. > There was the v3doublefree2.patch, a format patch and then the first git > reference in the tracker where they have re-arranged the free function so > it tracks the

Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-06-29 Thread Craig Small
Hi All There's a few goes of the required patches but I think I've got them all. There was the v3doublefree2.patch, a format patch and then the first git reference in the tracker where they have re-arranged the free function so it tracks the reference count. The result does compile and build

Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-06-28 Thread Sergio Durigan Junior
On Sunday, June 28 2020, Craig Small wrote: > On Fri, 26 Jun 2020 at 07:33, Andreas Hasenack > wrote: > >> we are not happy yet with those commits because they change a struct >> without bumping the soname. We are investigating how impactful that is. >> > > Hi, > Did you see how bad these

Bug#963713: [Pkg-net-snmp-devel] Bug#963713: net-snmp: CVE-2019-20892

2020-06-28 Thread Craig Small
On Fri, 26 Jun 2020 at 07:33, Andreas Hasenack wrote: > we are not happy yet with those commits because they change a struct > without bumping the soname. We are investigating how impactful that is. > Hi, Did you see how bad these patches are with the API change? Generally if the API is