Page MenuHomeVyOS Platform
Create Task
Maniphest T6324

CVE-2024-2961
Closed, ResolvedPublic
Actions

Description

According to https://security-tracker.debian.org/tracker/CVE-2024-2961 we need to update glibc
in sagitta - from 2.36-9+deb12u4 to 2.36-9+deb12u6
in equuleus - from 2.28-10+deb10u2 to 2.28-10+deb10u3

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.3.6, VyOS 1.4.0-epa2
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Security vulnerability

Event Timeline

a.apostoliuk triaged this task as Normal priority.Thu, May 9, 7:55 AM
a.apostoliuk created this task.
a.apostoliuk created this object in space S1 VyOS Public.
syncer changed the task status from Open to In progress.Thu, May 9, 8:03 AM
syncer moved this task from Need Triage to Backlog on the VyOS 1.3 Equuleus (1.3.7) board.
syncer moved this task from Need Triage to Backlog on the VyOS 1.4 Sagitta (1.4.0-epa3) board.
Viacheslav added a subscriber: Viacheslav.Thu, May 9, 8:08 AM

Fixed

vyos@r1-right:~$ show version all | match "GNU C L"
ii  libc-bin                             2.28-10+deb10u3                amd64        GNU C Library: Binaries
ii  libc-l10n                            2.28-10+deb10u3                all          GNU C Library: localization files
ii  libc6:amd64                          2.28-10+deb10u3                amd64        GNU C Library: Shared libraries
ii  locales                              2.28-10+deb10u3                all          GNU C Library: National Language (locale) data [support]
vyos@r1-right:~$ 
vyos@r1-right:~$ show version 

Version:          VyOS 1.3-stable-202405090514
Release train:    equuleus
syncer moved this task from Backlog to Finished on the VyOS 1.3 Equuleus (1.3.7) board.Thu, May 9, 8:15 AM
Viacheslav moved this task from Backlog to Finished on the VyOS 1.4 Sagitta (1.4.0-epa3) board.Thu, May 9, 8:16 AM
Viacheslav added a comment.Thu, May 9, 8:22 AM

For 1.4 also fixed

vyos@r1-right:~$ show version all | match "GNU C L"
ii  libc-bin                             2.36-9+deb12u7                   amd64        GNU C Library: Binaries
ii  libc-l10n                            2.36-9+deb12u7                   all          GNU C Library: localization files
ii  libc6:amd64                          2.36-9+deb12u7                   amd64        GNU C Library: Shared libraries
ii  locales                              2.36-9+deb12u7                   all          GNU C Library: National Language (locale) data [support]
vyos@r1-right:~$ 
vyos@r1-right:~$ show ver
Version:          VyOS 1.4-stable-202405090309
Release train:    sagitta
Viacheslav closed this task as Resolved.Thu, May 9, 8:33 AM
Viacheslav claimed this task.
pasik added a subscriber: pasik.Tue, May 14, 5:13 PM