Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5967 > unrolled thread
| Started by | Alexandre <alxgomz@gmail.com> |
|---|---|
| First post | 2021-09-11 11:00 +0200 |
| Last post | 2021-09-15 08:10 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.security
clarification on status of CVE-2021-33574 Alexandre <alxgomz@gmail.com> - 2021-09-11 11:00 +0200
Re: clarification on status of CVE-2021-33574 Salvatore Bonaccorso <carnil@debian.org> - 2021-09-15 08:10 +0200
| From | Alexandre <alxgomz@gmail.com> |
|---|---|
| Date | 2021-09-11 11:00 +0200 |
| Subject | clarification on status of CVE-2021-33574 |
| Message-ID | <CW71D-qY-1@gated-at.bofh.it> |
Hi Debian security list, I have something I can't really figure out. Is ther eany reason I'm missing why https://security-tracker.debian.org/tracker/CVE-2021-33574 shows all versions of Debian vulnerable , while it seems to only affect glibc 2.32 & 2.33 and all debian versions (but sid) use 2.31 at most? Regards
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2021-09-15 08:10 +0200 |
| Message-ID | <CXwhk-60f-3@gated-at.bofh.it> |
| In reply to | #5967 |
Hi Alexandre, On Sat, Sep 11, 2021 at 10:57:44AM +0200, Alexandre wrote: > Hi Debian security list, > > I have something I can't really figure out. Is ther eany reason I'm > missing why https://security-tracker.debian.org/tracker/CVE-2021-33574 > shows all versions of Debian vulnerable , while it seems to only > affect glibc 2.32 & 2.33 and all debian versions (but sid) use 2.31 at > most? In short: Do not trust version ranges in CVE descriptions. For an explanation why this affects older releases as well see the upstream issue https://sourceware.org/bugzilla/show_bug.cgi?id=27896 Furthermore it can be the case that affected versions were not yet triaged on Debian's side. Hope this helps, Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web