Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 928121 (CVE-2024-28176, CVE-2024-28180) - <app-containers/apptainer-1.3.0: two DoS vulnerabilities in the bundled library jose
Summary: <app-containers/apptainer-1.3.0: two DoS vulnerabilities in the bundled libra...
Status: CONFIRMED
Alias: CVE-2024-28176, CVE-2024-28180
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa?]
Keywords:
Depends on: 928120
Blocks:
  Show dependency tree
 
Reported: 2024-03-29 10:55 UTC by Marek Szuba
Modified: 2024-05-11 21:50 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marek Szuba archtester gentoo-dev 2024-03-29 10:55:18 UTC 
From 1.3.0 release notes:

"This release fixes two moderate severity denial of service vulnerabilities by upgrading a dependent library: CVE-2024-28176 and CVE-2024-28180."
Comment 1 Larry the Git Cow gentoo-dev 2024-03-29 13:41:13 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bff728ccef49fe4c5e834f9ea50a54f97c05b839

commit bff728ccef49fe4c5e834f9ea50a54f97c05b839
Author:     Marek Szuba <marecki@gentoo.org>
AuthorDate: 2024-03-29 13:40:19 +0000
Commit:     Marek Szuba <marecki@gentoo.org>
CommitDate: 2024-03-29 13:41:02 +0000

    app-containers/apptainer: drop 1.2.4
    
    No versions vulnerable to CVE-2024-28176, CVE-2024-28180 left in the
    tree.
    
    Bug: https://bugs.gentoo.org/928121
    Signed-off-by: Marek Szuba <marecki@gentoo.org>

 app-containers/apptainer/Manifest               |  1 -
 app-containers/apptainer/apptainer-1.2.4.ebuild | 92 -------------------------
 2 files changed, 93 deletions(-)