Source: box64 Severity: serious Tags: security Justification: security X-Debbugs-Cc: Gajendra Nath Soren <[email protected]>, [email protected]
> > CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in > > 4.20.0) > > > > The fix changes: > > char name[2 * ASN1_MAX_NAME_SIZE + 1] > > > > to: > > char name[2 * ASN1_MAX_NAME_SIZE + 2] > > > > This applies to two functions: asn1_expand_any_defined_by and > > asn1_expand_octet_string. > > box64 vendors a private copy of libtasn1 with the same partial-fix pattern: > > asn1_expand_any_defined_by updated, asn1_expand_octet_string still at + 1. Please fix and may be avoid vendoring ? THanks to Gajendra Nath Soren rouca
signature.asc
Description: This is a digitally signed message part.
