Bug#1082381: protobuf: CVE-2024-7254

2025-07-07 Thread Marc Deslauriers
On 2025-07-07 08:55, László Böszörményi (GCS) wrote: Hi, On Mon, Jul 7, 2025 at 1:51 PM Hlib Korzhynskyy wrote: The final merge commit from github [1] is what we used to fix this issue in Ubuntu. It should contain all of the relevant commits for the CVE. [1] https://github.com/protocolbuffer

Bug#1082381: protobuf: CVE-2024-7254

2025-07-07 Thread GCS
Hi, On Mon, Jul 7, 2025 at 1:51 PM Hlib Korzhynskyy wrote: > The final merge commit from github [1] is what we used to fix this issue in > Ubuntu. It should contain all of the relevant commits for the CVE. > [1] > https://github.com/protocolbuffers/protobuf/commit/4a197e78ad2430e22e992c5a7727b6

Bug#1082381: protobuf: CVE-2024-7254

2025-07-07 Thread Hlib Korzhynskyy
Hello, The final merge commit from github [1] is what we used to fix this issue in Ubuntu. It should contain all of the relevant commits for the CVE. Thanks, Hlib. [1] https://github.com/protocolbuffers/protobuf/commit/4a197e78ad2430e22e992c5a7727b61ae220f727 On Sat, 5 Jul 2025 at 12:45, Marc De

Bug#1082381: protobuf: CVE-2024-7254

2025-07-05 Thread Marc Deslauriers
Hi, I've added my colleague Hlib to CC, as he's the person who actually did the updates for Ubuntu and could perhaps help figure this out. Marc. On 2025-07-05 06:31, László Böszörményi (GCS) wrote: On Thu, Jul 3, 2025 at 11:07 PM Salvatore Bonaccorso wrote: Can you please double-check this

Bug#1082381: protobuf: CVE-2024-7254

2025-07-05 Thread GCS
On Thu, Jul 3, 2025 at 11:07 PM Salvatore Bonaccorso wrote: > Can you please double-check this, I think the issue is not yet fixed > (completely) in Debian. Marc Deslauriers pointed out that there are > commits missing (I updated the tracker now). Is his notes public? I'm checking the commits men

Bug#1082381: protobuf: CVE-2024-7254

2025-07-03 Thread Salvatore Bonaccorso
Hi Laszlo, On Fri, Sep 20, 2024 at 04:05:28PM +0200, Moritz Mühlenhoff wrote: > Source: protobuf > X-Debbugs-CC: t...@security.debian.org > Severity: important > Tags: security > > Hi, > > The following vulnerability was published for protobuf. > > CVE-2024-7254[0]: > | Any project that parses

Bug#1082381: protobuf: CVE-2024-7254

2024-09-20 Thread Moritz Mühlenhoff
Source: protobuf X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for protobuf. CVE-2024-7254[0]: | Any project that parses untrusted Protocol Buffers data containing | an arbitrary number of nested groups / series of SGROUP