Re: CVE-2021-38595 incorrectly marked as not affecting Qt 5?
Hi,
On Sun, Nov 28, 2021 at 05:32:07PM +0200, Adrian Bunk wrote:
> On Tue, Aug 31, 2021 at 09:15:15AM +0000, Raphaël Hertzog (@hertzog) wrote:
> >...
> > Commits:
> > 63957298 by Neil Williams at 2021-08-31T10:11:30+01:00
> > CVE-2021-38593/qt vulnerable code introduced later
> >...
> > Changes:
> >
> > =====================================
> > data/CVE/list
> > =====================================
> > @@ -3785,8 +3785,8 @@ CVE-2021-38595
> > CVE-2021-38594
> > RESERVED
> > CVE-2021-38593 (Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::c ...)
> > - - qtbase-opensource-src <unfixed>
> > - - qtbase-opensource-src-gles <unfixed>
> > + - qtbase-opensource-src <not-affected> (Vulnerable code introduced later)
> > + - qtbase-opensource-src-gles <not-affected> (Vulnerable code introduced later)
> > NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
> > NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml
> > NOTE: https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862 (6.1)
> >...
>
> Hi Neil,
>
> can you double-check that?
>
> Upload [1] makes me wonder whether the not-affected is correct,
> and "Qt 5.0.0 through 6.1.2" also implies all versions of
> qtbase-opensource-src{,-gles} would be affected.
I currently think the tracking from Neil was correct. The Issue was
introduced by the commit
2https://github.com/qt/qtbase/commit/6869d2463a2e0d71bd04dbc82f5d6ef4933dc510
.
Now the maintainer has today uploaded
https://tracker.debian.org/news/1281817/accepted-qtbase-opensource-src-5152dfsg-14-source-into-unstable/
claiming it fixes CVE-2021-38593. But looking at the changes it looks
that the debian/patches/CVE-2021-38593.diff patch both used
https://code.qt.io/cgit/qt/qtbase.git/commit/?id=f4d791b330d02777
introducing the needed "breaking" change, and then as well the fix.
See as well https://bugzilla.suse.com/show_bug.cgi?id=1189652#c2
arguing in the same direction.
We should recheck, but currently tend to that the tracking is already
correct.
Regards,
Salvatore
Reply to: