[libnbd PATCH] docs: Mention CVE-2023-5871
Point to the list archives for more details about the recent fix in commit 177308adb1. The issue is deemed low risk, but every security bug should be mentioned. Signed-off-by: Eric Blake <eblake@redhat.com> --- The URL may change as a result of getting the list migration stable (doing another re-import to get more than 2 years of list history may impact things); I'm also trying to figure out if mailman3/hyperkitty has a way to get a shorter permalink URL under 80 columns that will point to a given message. So for now, I'll hold off on pushing this patch until we know we are ready for it. --- docs/libnbd-security.pod | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod index 216efa43..6bbd6bd8 100644 --- a/docs/libnbd-security.pod +++ b/docs/libnbd-security.pod @@ -45,6 +45,12 @@ negative size result from nbd_get_size(3) See the full announcement here: L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html> +=head2 CVE-2023-5871 +assertion failure for 64-bit flags passed to nbd_block_status(3) + +See the full announcement here: +L<https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/5CRC7LRTN35WPZZ4BT6NAMH4JGMF47IK/> + =head1 SEE ALSO L<libnbd(3)>. -- 2.41.0
On Tue, Oct 31, 2023 at 09:54:16AM -0500, Eric Blake wrote:
Point to the list archives for more details about the recent fix in commit 177308adb1. The issue is deemed low risk, but every security bug should be mentioned.
Signed-off-by: Eric Blake <eblake@redhat.com>
---
The URL may change as a result of getting the list migration stable (doing another re-import to get more than 2 years of list history may impact things); I'm also trying to figure out if mailman3/hyperkitty has a way to get a shorter permalink URL under 80 columns that will point to a given message. So for now, I'll hold off on pushing this patch until we know we are ready for it. --- docs/libnbd-security.pod | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod index 216efa43..6bbd6bd8 100644 --- a/docs/libnbd-security.pod +++ b/docs/libnbd-security.pod @@ -45,6 +45,12 @@ negative size result from nbd_get_size(3) See the full announcement here: L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html>
+=head2 CVE-2023-5871 +assertion failure for 64-bit flags passed to nbd_block_status(3) + +See the full announcement here: +L<https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/5CRC7LRTN35WPZZ4BT6NAMH4JGMF47IK/> + =head1 SEE ALSO
Reviewed-by: Richard W.M. Jones <rjones@redhat.com> -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
On Tue, Oct 31, 2023 at 05:37:27PM +0000, Richard W.M. Jones wrote:
On Tue, Oct 31, 2023 at 09:54:16AM -0500, Eric Blake wrote:
Point to the list archives for more details about the recent fix in commit 177308adb1. The issue is deemed low risk, but every security bug should be mentioned.
Signed-off-by: Eric Blake <eblake@redhat.com>
---
The URL may change as a result of getting the list migration stable (doing another re-import to get more than 2 years of list history may impact things); I'm also trying to figure out if mailman3/hyperkitty has a way to get a shorter permalink URL under 80 columns that will point to a given message. So for now, I'll hold off on pushing this patch until we know we are ready for it.
Now that the list archives are stable, I've finally pushed this (commit 328ad118). I'll probably push a few other unannounced patches as I spot other URLs to update (such as where to report bugs, list archives, updating existing URLs where it makes sense, ...). -- Eric Blake, Principal Software Engineer Red Hat, Inc. Virtualization: qemu.org | libguestfs.org
participants (2)
-
Eric Blake -
Richard W.M. Jones