Already fixed upstream but not in a release.
Given the severity of the CVEs here, would you be able to apply the patch you gave upstream? If not, do you have a rough idea of when a release might be?
Ping - any plan?
Can you bump to 1.7.4p1?
(In reply to Sam James (sec padawan) from comment #3) > Can you bump to 1.7.4p1? oh, nevermind, I thought the fix was in there.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8e7a4cf914eb4cf0be07c35a0b6028c6929e9e14 commit 8e7a4cf914eb4cf0be07c35a0b6028c6929e9e14 Author: Jeroen Roovers <jer@gentoo.org> AuthorDate: 2020-06-17 04:26:47 +0000 Commit: Jeroen Roovers <jer@gentoo.org> CommitDate: 2020-06-17 04:42:01 +0000 net-analyzer/pmacct: Version 1.7.4_p1 Package-Manager: Portage-2.3.101, Repoman-2.3.22 Closes: https://bugs.gentoo.org/show_bug.cgi?id=719112 Closes: https://bugs.gentoo.org/show_bug.cgi?id=723226 Signed-off-by: Jeroen Roovers <jer@gentoo.org> net-analyzer/pmacct/Manifest | 1 + .../pmacct/files/pmacct-1.7.4-nDPI-3.2.patch | 47 ++++++++++ net-analyzer/pmacct/files/pmacctd-init.d | 2 +- net-analyzer/pmacct/pmacct-1.7.4_p1.ebuild | 103 +++++++++++++++++++++ 4 files changed, 152 insertions(+), 1 deletion(-)