CVE-2024-7592 version range fix
Dear NVD maintainers,
CVE-2024-7592 reported against Python is documented at
https://nvd.nist.gov/vuln/detail/CVE-2024-7592 as affecting all versions of Python prior to 3.12.5.
First of all, the entry is incorrect because the fix was merged for 3.12.6 and not 3.12.5, so in the 3.12.x branch, only >= 3.12.6 have the fix. The fix is commit
https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1,
which git clearly states was only merged in 3.12.6:
$ git tag --contains dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1 v3.12.6 v3.12.7 v3.12.8
In addition to that, the fix has been backported to the 3.9.x, 3.10.x and 3.11.x maintenance branches, so some versions numerically lower than 3.12.6 have the fix.
Namely:
* https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f
was merged in 3.11.10, so all 3.11.x versions >= 3.11.10 are not affected
* https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a
was merged in 3.10.15, so all 3.10.x versions >= 3.10.15 are not affected
* https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774
was merged in 3.9.20, so all 3.9.x versions >= 3.9.20 are not affected
See also
https://security-tracker.debian.org/tracker/CVE-2024-7592 for a good recap on this.
Would it be possible to fix the NVD entry for CVE-2024-7592 to take into account those extra details?
Thanks a lot!
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot