Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 891263 (CVE-2022-4121) - <net-libs/libetpan-1.9.4-r2: null pointer dereference
Summary: <net-libs/libetpan-1.9.4-r2: null pointer dereference
Status: IN_PROGRESS
Alias: CVE-2022-4121
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/dinhvh/libetpan/is...
Whiteboard: B3 [stable]
Keywords: PullRequest
Depends on: 930506
Blocks:
  Show dependency tree
 
Reported: 2023-01-18 04:42 UTC by John Helmert III
Modified: 2024-04-23 20:47 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-01-18 04:42:03 UTC 
CVE-2022-4121:

In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences.

Patch: https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a902317410181aacbba
Comment 1 Larry the Git Cow gentoo-dev 2024-04-22 15:51:41 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cbf4ae0b94c68b61515b0db19ac301ca8743deb8

commit cbf4ae0b94c68b61515b0db19ac301ca8743deb8
Author:     Christopher Fore <csfore@posteo.net>
AuthorDate: 2024-04-22 04:05:04 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2024-04-22 15:51:30 +0000

    net-libs/libetpan: Add patch for CVE-2022-4121
    
    - Also bump EAPI to version 8
    - Build succeeds on amd64
      - Tests don't seem to run
    
    Bug: https://bugs.gentoo.org/891263
    Signed-off-by: Christopher Fore <csfore@posteo.net>
    Closes: https://github.com/gentoo/gentoo/pull/36351
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 .../files/libetpan-1.9.4-CVE-2022-4121.patch       | 29 ++++++++
 net-libs/libetpan/libetpan-1.9.4-r2.ebuild         | 78 ++++++++++++++++++++++
 2 files changed, 107 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2024-04-23 20:47:54 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b57f7745a548c4104151f06d0da66a2d0266af6f

commit b57f7745a548c4104151f06d0da66a2d0266af6f
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2024-04-23 20:47:09 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2024-04-23 20:47:09 +0000

    net-libs/libetpan: drop 1.9.4-r1
    
    Bug: https://bugs.gentoo.org/891263
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 net-libs/libetpan/libetpan-1.9.4-r1.ebuild | 77 ------------------------------
 1 file changed, 77 deletions(-)