On 21.05.2023 21:06, Salvatore Bonaccorso wrote: Hello Salvatore,
The following vulnerability was published for texlive-bin. CVE-2023-32668[0]: | LuaTeX before 1.17.0 allows a document (compiled with the default | settings) to make arbitrary network requests. This occurs because full | access to the socket library is permitted by default, as stated in the | documentation. This also affects TeX Live before 2023 r66984 and | MiKTeX before 23.5.
I updated to luatex 1.17.0 already in the TeX Live binaries for TL 2023 in commit 5348a805847c038d92c80a9b208da48dc527decd, the needed adaptions for Context were made, but all that needs to be tested.
Is that sufficient or do we need to fix all this in bookworm / bullseye too? Hilmar -- sigfault
OpenPGP_0x0C871C4C653C1F59.asc
Description: OpenPGP public key
OpenPGP_signature
Description: OpenPGP digital signature