Re: BerkeleyDB CVEs

[Sylvain Beucler]

Hi,

On 26/09/2025 17:18, Carlos Henrique Lima Melara wrote:
On Fri, Sep 26, 2025 at 12:43:43PM +0000, Tomáš Macák wrote:
One of our customers is performing thorough security audit test. Amongst others 
they are checking SBOM file of OS and reviewing it with BlackDuck
They came up with list of high criticality CVEs from Oracle Berkeley DB 
libdb5.3 package, which on your tracker list are marked as “NOT-FOR-US: 
Oracle”. They argue that package libdb5.3/5.3.28 is installed which is affected 
accrding to Oracle 
(https://www.oracle.com/security-alerts/cpuapr2017.html#AppendixTOOL) thus 
we’re vulnerable

Can you please let us know, if these CVEs

   1.  Really affect Debian, but since the code is external/Oracle you cannot 
fix it – marked NFU
   2.  Portions of code in CVEs is not present/used in Debian libdb package

I strongly believe it’s b) but I have very few arguments I can play with ☹

If they paid for the security assessment, isn't part of the job triaging
the report to make sure the CVEs reported aren't false positives
outputed by some automated tool? That's what I would ask your customer.

I understand for now I cannot simple remove libdb for now as PAM module depends 
on it

The list of CVEs:
CVE-2016-0682, CVE-2016-0689, CVE-2016-0692, CVE-2016-0694, CVE-2016-3418, 
CVE-2017-3604, CVE-2017-3605, CVE-2017-3606, CVE-2017-3607, CVE-2017-3608, 
CVE-2017-3609, CVE-2017-3610, CVE-2017-3611, CVE-2017-3612, CVE-2017-3613, 
CVE-2017-3614, CVE-2017-3615, CVE-2017-3616, CVE-2017-3617, CVE-2020-2981, 
CVE-2015-2583, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-4754, 
CVE-2015-2624, CVE-2015-4784, CVE-2015-2656, CVE-2015-4787, CVE-2015-4789, 
CVE-2015-4785, CVE-2015-4786, CVE-2015-4783, CVE-2015-4764, CVE-2015-4780, 
CVE-2015-4790, CVE-2015-4776, CVE-2015-4775, CVE-2015-4778, CVE-2015-4777, 
CVE-2015-4782, CVE-2015-4781, CVE-2015-4774

I did look at the first 2 CVEs in the security tracker and they read
[1][2]:

NOT-FOR-US: Oracle Berkeley DB (later closed source releases)

So I'd guess this is true to all others, but again I feel this is part
of the job of the third party doing the security assessment to verify,
not yours and not secteam's.

Additionally, NFU is described at:
https://security-team.debian.org/security_tracker.html#issues-not-for-us-nfu
and should mean Debian doesn't ship affected software _at all_.

Note: later BDB are not closed source but dual-licensed AGPL, there 
appears to be a typo here, or maybe that changed since the 2016 triage.

In any case Debian shouldn't be affected, but as Jeremy noted there's 
little information:
https://www.cve.org/CVERecord?id=CVE-2016-0682
"Unspecified vulnerability ... via unknown vectors ..."

Contact Oracle, or BlackDuck since they appear to have information we 
don't :)

Cheers!
Sylvain