Re: clarification on status of CVE-2021-33574

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.security
Subject	Re: clarification on status of CVE-2021-33574
Date	2021-09-15 08:10 +0200
Message-ID	<CXwhk-60f-3@gated-at.bofh.it> (permalink)
References	<CW71D-qY-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi Alexandre,

On Sat, Sep 11, 2021 at 10:57:44AM +0200, Alexandre wrote:
> Hi Debian security list,
>
> I have something I can't really figure out. Is ther eany reason I'm
> missing why https://security-tracker.debian.org/tracker/CVE-2021-33574
> shows all versions of Debian vulnerable , while it seems to only
> affect glibc 2.32 & 2.33 and all debian versions (but sid) use 2.31 at
> most?

In short: Do not trust version ranges in CVE descriptions.

For an explanation why this affects older releases as well see the
upstream issue https://sourceware.org/bugzilla/show_bug.cgi?id=27896

Furthermore it can be the case that affected versions were not yet
triaged on Debian's side.

Hope this helps,

Regards,
Salvatore

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

clarification on status of CVE-2021-33574 Alexandre <alxgomz@gmail.com> - 2021-09-11 11:00 +0200
  Re: clarification on status of CVE-2021-33574 Salvatore Bonaccorso <carnil@debian.org> - 2021-09-15 08:10 +0200

csiph-web