Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 938117 (TROVE-2024-009) - <net-p2p/arti-1.2.6: undefined behavior in openssl crate
Summary: <net-p2p/arti-1.2.6: undefined behavior in openssl crate
Status: RESOLVED FIXED
Alias: TROVE-2024-009
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: https://gitlab.torproject.org/tpo/cor...
Whiteboard: ~4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2024-08-17 19:35 UTC by John Helmert III
Modified: 2024-08-17 19:40 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2024-08-17 19:35:19 UTC 
The upstream openssl crate advisory is RUSTSEC-2024-0357, "MemBio::get_buf has undefined behavior with empty buffers". Fixed downstream in Arti 1.2.6.
Comment 1 Larry the Git Cow gentoo-dev 2024-08-17 19:37:28 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d690add7b2ece260b7c587785c07e35ba5df3602

commit d690add7b2ece260b7c587785c07e35ba5df3602
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2024-08-17 19:36:13 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2024-08-17 19:37:03 +0000

    net-p2p/arti: drop 1.2.5
    
    Bug: https://bugs.gentoo.org/938117
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 net-p2p/arti/Manifest          |  83 ------
 net-p2p/arti/arti-1.2.5.ebuild | 586 -----------------------------------------
 2 files changed, 669 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=801785119109108a0de238e466c80e776a15a98d

commit 801785119109108a0de238e466c80e776a15a98d
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2024-08-17 14:48:55 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2024-08-17 19:37:03 +0000

    net-p2p/arti: add 1.2.6
    
    Bug: https://bugs.gentoo.org/938117
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 net-p2p/arti/Manifest          | 108 ++++++++
 net-p2p/arti/arti-1.2.6.ebuild | 611 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 719 insertions(+)