Date: Fri, 27 Jun 2014 06:37:40 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: LMS-2014-06-16-6: LZ4 Core On Thu, Jun 26, 2014 at 12:58:37PM -0600, Don A. Bailey wrote: > A vulnerability has been identified in the LZ4 core implementation. Please > review the bug report attached inline. [...] > Report ID: LMS-2014-06-16-6 > > CVE ID: CVE-2014-4611 [...] > Vulnerability Status: Reported / No response Yann Collet, the author of LZ4 and maintainer of the LZ4 reference implementation, has now posted a different point of view: http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html Aside from the bitterness (which I think is excessive, albeit understandable), there's technical detail on why the vulnerability is less severe, and a mention of it having been reported via "a brief note on the LZ4 issue board". I've just found this note here: https://code.google.com/p/lz4/issues/detail?id=52&can=1 I guess there was some miscommunication, because there _was_ response via comments on this issue. Don's comment was posted on June 19, and Yann replied via multiple comments on June 20, 22, 26. The latest one of these says "Fixed into r118", which is: https://code.google.com/p/lz4/source/detail?r=118 and the commit message includes: "fix : Issue 52 (malicious address space overflow in 32-bits mode when using custom format)" Per Yann's blog post, and per comments on issue 52, we should credit Ludvig Strigeus for earlier discovery of this issue specifically in LZ4, although it was not treated as a security issue until Don's rediscovery (per Yann's good reasons, it shouldn't have been, but that's arguable). Given the above, I think all of Ludvig, Don, and indeed Yann deserve credit for getting this issue fixed, and I find it unfortunate that feelings were hurt. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ