Bug 8610 - readline 6.3 has open CVE
Summary: readline 6.3 has open CVE
Status: VERIFIED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 2.0.1
Assignee: Armin Kuster
QA Contact: Alexandru Roman
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2015-10-29 12:18 UTC by Elena Reshetova
Modified: 2016-07-15 11:40 UTC (History)
6 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Elena Reshetova 2015-10-29 12:18:19 UTC 
readline 6.3 has open CVE-2014-2524
Comment 1 Paul Eggleton 2015-10-29 15:04:32 UTC 
Further details:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2524
https://bugzilla.redhat.com/show_bug.cgi?id=1077023

RH assessed this one as low severity, FWIW.
Comment 2 Armin Kuster 2015-10-29 15:33:31 UTC 
The CVSS score is low.

I recommend that we address this issue in a future update possible via a package update.
Comment 4 Alexandru Roman 2016-01-18 13:54:47 UTC 
Verified on jethro 2.0.1 : dd0ba9ea4a11ab15348d4fe3574e4b28784db82f