Your message dated Sat, 06 Sep 2025 12:14:57 +0100
with message-id
<165032e5317517556dd7fd8cf24843112a3fb6ac.ca...@adam-barratt.org.uk>
and subject line Closing p-u requests for fixes included in 13.1
has caused the Debian Bug report #1112335,
regarding trixie-pu: libcoap3/4.3.4-1.1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1112335: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112335
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu
The attached debdiff for libcoap3 fixes CVE-2024-0962 and CVE-2024-31031 in
Trixie.
Though the CVEs are marked as ignored by the security team, they are still
bugs, that I would like to get fixed.
libcoap3 is a leaf package with no rdeps within Debian and the fix was
already done by upstream some time ago. There should be not much hassle
with this fix.
Thorsten
diff -Nru libcoap3-4.3.4/debian/changelog libcoap3-4.3.4/debian/changelog
--- libcoap3-4.3.4/debian/changelog 2024-02-29 19:39:26.000000000 +0100
+++ libcoap3-4.3.4/debian/changelog 2025-08-27 08:03:02.000000000 +0200
@@ -1,3 +1,13 @@
+libcoap3 (4.3.4-1.1+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload by the LTS Team.
+ * CVE-2024-0962 (Closes: #1061704)
+ fix stacked-based buffer overflow
+ * CVE-2024-31031 (Closes: #1070362)
+ fix unsigned integer overflow
+
+ -- Thorsten Alteholz <[email protected]> Wed, 27 Aug 2025 08:03:02 +0200
+
libcoap3 (4.3.4-1.1) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru libcoap3-4.3.4/debian/patches/CVE-2024-0962.patch
libcoap3-4.3.4/debian/patches/CVE-2024-0962.patch
--- libcoap3-4.3.4/debian/patches/CVE-2024-0962.patch 1970-01-01
01:00:00.000000000 +0100
+++ libcoap3-4.3.4/debian/patches/CVE-2024-0962.patch 2025-08-27
08:03:02.000000000 +0200
@@ -0,0 +1,33 @@
+commit 2b28d8b0e9607e71a145345b4fe49517e052b7d9
+Author: Jon Shallow <[email protected]>
+Date: Thu Jan 25 18:03:17 2024 +0000
+
+ coap_oscore.c: Fix parsing OSCORE configuration information
+
+Index: libcoap3-4.3.4/src/coap_oscore.c
+===================================================================
+--- libcoap3-4.3.4.orig/src/coap_oscore.c 2025-08-27 10:05:54.081520985
+0200
++++ libcoap3-4.3.4/src/coap_oscore.c 2025-08-27 10:05:54.081520985 +0200
+@@ -1672,11 +1672,12 @@
+ oscore_value_t *value) {
+ const char *begin = *start;
+ const char *end;
++ const char *kend;
+ const char *split;
+ size_t i;
+
+ retry:
+- end = memchr(begin, '\n', size);
++ kend = end = memchr(begin, '\n', size);
+ if (end == NULL)
+ return 0;
+
+@@ -1687,7 +1688,7 @@
+
+ if (begin[0] == '#' || (end - begin) == 0) {
+ /* Skip comment / blank line */
+- size -= end - begin + 1;
++ size -= kend - begin + 1;
+ begin = *start;
+ goto retry;
+ }
diff -Nru libcoap3-4.3.4/debian/patches/CVE-2024-31031.patch
libcoap3-4.3.4/debian/patches/CVE-2024-31031.patch
--- libcoap3-4.3.4/debian/patches/CVE-2024-31031.patch 1970-01-01
01:00:00.000000000 +0100
+++ libcoap3-4.3.4/debian/patches/CVE-2024-31031.patch 2025-08-27
08:03:02.000000000 +0200
@@ -0,0 +1,75 @@
+commit 214665ac4b44b1b6a7e38d4d6907ee835a174928
+Author: Jon Shallow <[email protected]>
+Date: Mon Mar 25 20:44:48 2024 +0000
+
+ coap_pdu.c: Fix UndefinedBehaviorSanitizer: undefined-behavior
+
+ This fixes a reported error in coap_update_token() where a size_t
+ calculation is overflowed (but all ends up with the correct value).
+
+ Instead of adding an overflowed size_t, now subtract the reversed
+ size_t calculation as appropriate.
+
+ coap_update_option() and coap_insert_option() similarly updated.
+
+Index: libcoap3-4.3.4/src/coap_pdu.c
+===================================================================
+--- libcoap3-4.3.4.orig/src/coap_pdu.c 2025-08-28 15:37:34.889583463 +0200
++++ libcoap3-4.3.4/src/coap_pdu.c 2025-08-28 15:37:34.885583460 +0200
+@@ -389,12 +389,15 @@
+ memmove(&pdu->token[(len + bias) - pdu->e_token_length],
+ pdu->token, pdu->used_size);
+ pdu->used_size += len + bias - pdu->e_token_length;
++ if (pdu->data) {
++ pdu->data += (len + bias) - pdu->e_token_length;
++ }
+ } else {
+ pdu->used_size -= pdu->e_token_length - (len + bias);
+ memmove(pdu->token, &pdu->token[pdu->e_token_length - (len + bias)],
pdu->used_size);
+- }
+- if (pdu->data) {
+- pdu->data += (len + bias) - pdu->e_token_length;
++ if (pdu->data) {
++ pdu->data -= pdu->e_token_length - (len + bias);
++ }
+ }
+
+ pdu->actual_token.length = len;
+@@ -641,9 +644,15 @@
+ number - prev_number, data, len))
+ return 0;
+
+- pdu->used_size += shift - shrink;
+- if (pdu->data)
+- pdu->data += shift - shrink;
++ if (shift >= shrink) {
++ pdu->used_size += shift - shrink;
++ if (pdu->data)
++ pdu->data += shift - shrink;
++ } else {
++ pdu->used_size -= shrink - shift;
++ if (pdu->data)
++ pdu->data -= shrink - shift;
++ }
+ return shift;
+ }
+
+@@ -681,9 +690,15 @@
+ decode.delta, data, len))
+ return 0;
+
+- pdu->used_size += new_length - old_length;
+- if (pdu->data)
+- pdu->data += new_length - old_length;
++ if (new_length >= old_length) {
++ pdu->used_size += new_length - old_length;
++ if (pdu->data)
++ pdu->data += new_length - old_length;
++ } else {
++ pdu->used_size -= old_length - new_length;
++ if (pdu->data)
++ pdu->data -= old_length - new_length;
++ }
+ return 1;
+ }
+
diff -Nru libcoap3-4.3.4/debian/patches/series
libcoap3-4.3.4/debian/patches/series
--- libcoap3-4.3.4/debian/patches/series 1970-01-01 01:00:00.000000000
+0100
+++ libcoap3-4.3.4/debian/patches/series 2025-08-27 08:03:02.000000000
+0200
@@ -0,0 +1,2 @@
+CVE-2024-0962.patch
+CVE-2024-31031.patch
--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 13.1
Hi,
Each of the updates referenced by these requests was included in
today's 13.1 point release for trixie.
Regards,
Adam
--- End Message ---
