Your message dated Mon, 28 Oct 2024 18:26:00 +0000
with message-id <e1t5ure-004ex8...@fasolo.debian.org>
and subject line Bug#1082511: fixed in micropython 1.24.0+ds-1
has caused the Debian Bug report #1082511,
regarding micropython: CVE-2024-8946 CVE-2024-8947 CVE-2024-8948
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1082511: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082511
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: micropython
Version: 1.22.1+ds-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi,
The following vulnerabilities were published for micropython.
CVE-2024-8946[0]:
| A vulnerability was found in MicroPython 1.23.0. It has been
| classified as critical. Affected is the function mp_vfs_umount of
| the file extmod/vfs.c of the component VFS Unmount Handler. The
| manipulation leads to heap-based buffer overflow. It is possible to
| launch the attack remotely. The exploit has been disclosed to the
| public and may be used. The name of the patch is
| 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply
| a patch to fix this issue. In the VFS unmount process, the
| comparison between the mounted path string and the unmount requested
| string is based solely on the length of the unmount string, which
| can lead to a heap buffer overflow read.
CVE-2024-8947[1]:
| A vulnerability was found in MicroPython 1.22.2. It has been
| declared as critical. Affected by this vulnerability is an unknown
| functionality of the file py/objarray.c. The manipulation leads to
| use after free. The attack can be launched remotely. The complexity
| of an attack is rather high. The exploitation appears to be
| difficult. Upgrading to version 1.23.0 is able to address this
| issue. The identifier of the patch is
| 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to
| upgrade the affected component. In micropython objarray component,
| when a bytes object is resized and copied into itself, it may
| reference memory that has already been freed.
CVE-2024-8948[2]:
| A vulnerability was found in MicroPython 1.23.0. It has been rated
| as critical. Affected by this issue is the function mpz_as_bytes of
| the file py/objint.c. The manipulation leads to heap-based buffer
| overflow. The attack may be launched remotely. The exploit has been
| disclosed to the public and may be used. The patch is identified as
| 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply
| a patch to fix this issue. In micropython objint component,
| converting zero from int to bytes leads to heap buffer-overflow-
| write at mpz_as_bytes.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-8946
https://www.cve.org/CVERecord?id=CVE-2024-8946
[1] https://security-tracker.debian.org/tracker/CVE-2024-8947
https://www.cve.org/CVERecord?id=CVE-2024-8947
[2] https://security-tracker.debian.org/tracker/CVE-2024-8948
https://www.cve.org/CVERecord?id=CVE-2024-8948
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: micropython
Source-Version: 1.24.0+ds-1
Done: Yangfl <mmyan...@gmail.com>
We believe that the bug you reported is fixed in the latest version of
micropython, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1082...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Yangfl <mmyan...@gmail.com> (supplier of updated micropython package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 27 Oct 2024 10:51:24 +0800
Source: micropython
Architecture: source
Version: 1.24.0+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Yangfl <mmyan...@gmail.com>
Changed-By: Yangfl <mmyan...@gmail.com>
Closes: 1075865 1082511
Changes:
micropython (1.24.0+ds-1) unstable; urgency=medium
.
* New upstream release
* Fix FTBFS with MbedTLS 3.6 (Closes: #1075865)
* Fix CVE-2024-8946 CVE-2024-8947 CVE-2024-8948 (Closes: #1082511)
* Bump Standards-Version to 4.7.0
Checksums-Sha1:
23a5f2e67f61bc035a395b2545e31895102a05fe 2119 micropython_1.24.0+ds-1.dsc
653f37decb42419ac6a35defa0dcccc204661b04 5854380
micropython_1.24.0+ds.orig.tar.xz
d46f16d95beb6ec05dd8dfaa97630966eae432e1 11844
micropython_1.24.0+ds-1.debian.tar.xz
28ee8cbb8670f0c34f79c856d54ffee7f8bc8848 8945
micropython_1.24.0+ds-1_amd64.buildinfo
Checksums-Sha256:
0f3d8d3351f643282c8d1f304f0d5006354ea2c0bfc65a2e8348d25d1ee2b199 2119
micropython_1.24.0+ds-1.dsc
29b6de7864e21af7be23844c554d77ca1c80bd7d847371e76fadc9ce4bdf9db3 5854380
micropython_1.24.0+ds.orig.tar.xz
84cb9f1acf9494b8b2b18a6b22ad99be30db98af1602ec7de4959b03e4e29843 11844
micropython_1.24.0+ds-1.debian.tar.xz
fdd74d7bdf7a55903340e0f4b848bd96e5b1dcc5ab52afa7dcfdd8c6bda504e3 8945
micropython_1.24.0+ds-1_amd64.buildinfo
Files:
da5228d6f5bda5f3a6e290e9a91dbbf4 2119 python optional
micropython_1.24.0+ds-1.dsc
05e51871cb5ff2b0ebf00d27b16da339 5854380 python optional
micropython_1.24.0+ds.orig.tar.xz
7b84c6e8ee999f6487fc5a5a82734796 11844 python optional
micropython_1.24.0+ds-1.debian.tar.xz
492438a5ad525a01aa5fdded796c6de9 8945 python optional
micropython_1.24.0+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfncpR22H1vEdkazLwpPntGGCWs4FAmcfsbEACgkQwpPntGGC
Ws5fcg//TxXZHtMIxZEe4RNHcuKTae7J3TfcO+ozlccqTls1u4/e2QAoNJ8eWz+E
T4qsOioavyGx1UXgjfQLHkYUysMdG8/yhY/J/951vjsFwRzwjDrchcouU6wMeE/Y
qnIcAm6QGB/7OYJj6MGOcWOt6/jSO6Zg2p12bgzF/usUOhxjQy6ElSW0KGyaIbWJ
a7/VV5KLnI0GMa32b6qaqcnocphrwezVIqW51TvpMg+yaBi97t6DvYVPWChXpSET
HRVemQh9GkUQ8lGfUZ1tnnsXpJbI0KPPILvHgbjqs2iRFe1Ja0tl7owY4y3mJQZC
3r63r2CiU2pqdolWtcDXtCPBelqKSvLZFxVLGFWm239+/vk1OyiTXEvwWj2KYj41
u0mj7G1q9etH0dj2KsLJNmsZgFDeo/ZA4zFwJtG76qFWO2c2hLlylNCFhIjqDe6C
XfDq/ZDd04k/1sJ1UhgI1ZRMCJ/FmB6IdqPKN2ijgrKtiBNRq8E2xhHKieO/iD24
dTCLO2qr1nv/JNp2CINSrGYbD7o18PamUBFye+KY2E/vowMGF8cOGvt3OmCUidcp
brN/wgkmiGtr7hFL+FD8VZtyOPD9G0ghL449RNKlHjuQnfk2LXQjS+7HYwDDEmNk
sMqvJKlVHvkpLLvK5Y7WUFE1qPoLmUTvAtoDnZfj+aMAzW8Co4s=
=LPCx
-----END PGP SIGNATURE-----
pgpvVvheBjDhj.pgp
Description: PGP signature
--- End Message ---
