[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <231b522b-4943-439a-8e41-9dac3cf3953d@oracle.com>
Date: Tue, 12 Nov 2024 09:50:11 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: 4 recent security bugs in GNOME's libsoup
On 11/9/24 10:45, Alan Coopersmith wrote:
> https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home lists four security
> vulnerabilities reported against libsoup since June 2024, none of which have
> CVE id's listed as being assigned. (For those not familiar with it, libsoup is
> an HTTP client/server library for the GNOME desktop.)
It appears that Mitre issued CVE id's for the first 3 of these yesterday:
> 1) Request smuggling via stripping of null bytes from the ends of header names
> https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
https://www.cve.org/CVERecord?id=CVE-2024-52530
> 2) headers: Be more robust against invalid input when parsing params
> https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407
https://www.cve.org/CVERecord?id=CVE-2024-52531
> 3) Infinite loop while reading websocket data
> https://gitlab.gnome.org/GNOME/libsoup/-/issues/391
https://www.cve.org/CVERecord?id=CVE-2024-52532
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
