CVE-2019-9578 (https://nvd.nist.gov/vuln/detail/CVE-2019-9578): In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. Please remove all previous version. They are masked, but as time permits please put up the new version and remove the ones that are vulnerable
This is actually _affects_ stable
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1a1fc80ba7e47494400019c924245aff51b8307e commit 1a1fc80ba7e47494400019c924245aff51b8307e Author: Göktürk Yüksek <gokturk@gentoo.org> AuthorDate: 2019-06-05 20:00:59 +0000 Commit: Göktürk Yüksek <gokturk@gentoo.org> CommitDate: 2019-06-05 20:05:25 +0000 app-crypt/libu2f-host: bump to 1.1.10 Bug: https://bugs.gentoo.org/678580 Bug: https://bugs.gentoo.org/679724 Package-Manager: Portage-2.3.67, Repoman-2.3.12 Signed-off-by: Göktürk Yüksek <gokturk@gentoo.org> app-crypt/libu2f-host/Manifest | 1 + app-crypt/libu2f-host/libu2f-host-1.1.10.ebuild | 47 +++++++++++++++++++++++++ 2 files changed, 48 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=51323d25822747871328d2d8578f48cdd5dbe8c5 commit 51323d25822747871328d2d8578f48cdd5dbe8c5 Author: Göktürk Yüksek <gokturk@gentoo.org> AuthorDate: 2019-06-08 19:08:27 +0000 Commit: Göktürk Yüksek <gokturk@gentoo.org> CommitDate: 2019-06-08 19:08:27 +0000 app-crypt/libu2f-host: remove old vulnerable #678580 #679724 Bug: https://bugs.gentoo.org/678580 Bug: https://bugs.gentoo.org/679724 Package-Manager: Portage-2.3.67, Repoman-2.3.12 Signed-off-by: Göktürk Yüksek <gokturk@gentoo.org> app-crypt/libu2f-host/Manifest | 3 -- app-crypt/libu2f-host/libu2f-host-1.1.1.ebuild | 63 -------------------------- app-crypt/libu2f-host/libu2f-host-1.1.3.ebuild | 55 ---------------------- app-crypt/libu2f-host/libu2f-host-1.1.6.ebuild | 55 ---------------------- 4 files changed, 176 deletions(-)
GLSA Vote: Yes Added to an existing GLSA Request.
This issue was resolved and addressed in GLSA 202004-15 at https://security.gentoo.org/glsa/202004-15 by GLSA coordinator Thomas Deutschmann (whissi).
