Re: CVE-2023-43628?

[Jon Schlueter]

What would probably be best is to get any issue resolved with a commit referencing that CVE but also that the feature/bug came in with development code since latest release and then a message can be sent to get the CVE closed with Note, only impacted development branch and this project uses Release tags.

Maybe they will close it, maybe not but if there is a commit with details and description there is less drama around it.

Jon Schlueter

On Mon, Dec 11, 2023 at 2:49 PM Gary E. Miller <gem@rellim.com> wrote:

Yo Miroslav!

On Mon, 11 Dec 2023 12:46:25 +0100
Miroslav Lichvar <mlichvar@redhat.com> wrote:

> There is a report of a security vulnerability in gpsd:
>
> https://talosintelligence.com/vulnerability_reports/TALOS-2023-1860

Sadly, yes.

> The report says 3.25.1~dev.

It originally said 3.25.1, at least I got that fixed.

> I don't see a 3.25.1 release and the 3.25
> code seems very different.

Yes.  This CVE is to recently added code for a new eature (HTTP
chunking of NTRIP v2).  To "explout" this you need to configure
gpsd to contact a hostile NTRIP server.  And then you get a
crash.  It needed to be  fixed before release, and it was nice
of them to report it clearly, but ding gpsd with a CVE is just
causing FUD.

I expect out usual prerelease process (Codacy, Coverity, etc.) would
have caught this if it has persisted that long.

> Does anyone know why a CVE was assigned for
> this?

I'm sure someone does, but none of us.  I objected, but that
never does any good.

> If this doesn't impact an actual release, could you please
> dispute it with MITRE?

Talos is Cisco, not Mitre.  Cisco has always done what Cisco wants to

This sort of thing is whey I am confused by the !CVE projejct.  They
complain that mainters are refusing CVE on real bugs.  I've never seen
anyone be able to stop a CVE.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
        gem@rellim.com  Tel:+1 541 382 8588

            Veritas liberabit vos. -- Quid est veritas?
    "If you can't measure it, you can't improve it." - Lord Kelvin