Source: libcoap3 Version: 4.3.4-1 Severity: important Tags: security upstream Forwarded: https://github.com/obgm/libcoap/issues/1310 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for libcoap3. CVE-2024-0962[0]: | A vulnerability was found in obgm libcoap 4.3.4. It has been rated | as critical. Affected by this issue is the function get_split_entry | of the file src/coap_oscore.c of the component Configuration File | Handler. The manipulation leads to stack-based buffer overflow. The | attack may be launched remotely. The exploit has been disclosed to | the public and may be used. It is recommended to apply a patch to | fix this issue. VDB-252206 is the identifier assigned to this | vulnerability. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-0962 https://www.cve.org/CVERecord?id=CVE-2024-0962 [1] https://github.com/obgm/libcoap/issues/1310 [2] https://github.com/obgm/libcoap/pull/1311 [3] https://github.com/obgm/libcoap/commit/2b28d8b0e9607e71a145345b4fe49517e052b7d9 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
