search

HardySimpson / zlog

A reliable, high-performance, thread safe, flexsible, clear-model, pure C logging library.
Apache License 2.0
2.24k stars 720 forks source link

Severe Vulnerability in zlog 1.2.17 #250

Closed faran1512 closed 8 months ago

faran1512 commented 8 months ago

We have found a severe vulnerability that can be exploited. We want you to patch the vulnerability before we disclose this publicly. We have emailed (HardySimpson1984@gmail.com) but no response has been made. Contact us before we publicly disclose it.

Thanks

CC @alirazamumtaz

locus-x64 commented 8 months ago

Furthermore, we have reserved a CVE number with @CVEProject

ptitvert commented 8 months ago

I am not part of the project, but did you try your vulnerability on 1.2.17, which is the latest release? From my own perspective to have such severe message on a severe vulnerability, it would make sense to check on the latest version and not one which was published nearly 2 years ago.

If yes, and your discovery is also valid for 1.2.17, then say so. It is like if you said, I have found a severe vulnerability on Windows 11 from 2 years ago. I would like to know about the current status, not the past.

It looks like for me, that the 1.2.17 is not impacted, but only 1.2.16.

But again, I am not part of the project, just a user of the library, which finds your ticket strange.

locus-x64 commented 8 months ago

Yes, the latest version (1.2.17) is also vulnerable.

solardiz commented 8 months ago

This is now also brought up in https://www.openwall.com/lists/oss-security/2024/02/28/2, and as oss-security moderator I'm going to ask for actual detail to be posted publicly soon, ideally along with a proposed patch, which I guess can also be sent via a pull request in here.

It appears that @HardySimpson is currently mostly inactive on GitHub and with the project - only one contribution in a year (on December 4), so it may not make sense to wait for a response much longer. Hopefully, someone else with the project is able to merge a PR and make a release? Please speak up.

solardiz commented 8 months ago

@deemar I see you were the one to merge recent PRs. Would you take care of this issue as well, please? Coordinate with @faran1512 and @alirazamumtaz on them sharing the actual vulnerability detail and proposed fix with the project, merge it, make a release.

The issue is now described on oss-security as "essentially a heap-based buffer overflow leading to denial of service and arbitrary code execution" and is CVE-2024-22857.

If the issue is in fact as described, I think it's reasonable to plan on having the fix merged within a week from now. Realistic?

deemar commented 8 months ago

@solardiz @faran1512 please give more details or push your PR and I will deal with it

solardiz commented 8 months ago

@deemar I don't have more details - @faran1512 and @alirazamumtaz say they do. I am merely helping them coordinate the disclosure. Would you like them to make this information public right away (such as in comments to this issue or in a PR), or should they communicate it to you privately first? Either way has its pros and cons, so this is up to you - please just state your preference. Thank you!

deemar commented 8 months ago

@solardiz Then I hope @faran1512 and @alirazamumtaz can give me some more detail. No need of private communication. Make everything public please.

locus-x64 commented 8 months ago

Thank you @solardiz for your help in this disclosure. @deemar we have made a pull request #251 along with an intended patch. Let us know if you need more information. Thank you!

faran1512 commented 8 months ago

The issue has been patched and thanks @solardiz and @deemar for coordination. I am now closing this issue now.

Xumin-chen commented 4 months ago

This vulnerability is closed. Why is 1.2.17 the tag not attached? Thanks.

zhouyunbin commented 4 months ago

您好，已收到您的来信

Xumin-chen commented 4 months ago

In 1.2.17 the tag,this vulnerability is not closed. zlog

locus-x64 commented 4 months ago

It will be patch in the next tag. @deemar it seems you have not created any patched tag yet.

deemar commented 4 months ago

I will make a new release

Xumin-chen commented 4 months ago

Can I ask there is no officially released version to repair the vulnerability CVE-2024-22859? Thanks.

deemar commented 4 months ago

Just made a new release: https://github.com/HardySimpson/zlog/releases/tag/1.2.18

Xumin-chen commented 4 months ago

Thanks. So the vulnerability CVE-2024-22859 repair in 1.2.18 and the others is not repaired. Right?

deemar commented 4 months ago

Thanks. So the vulnerability CVE-2024-22859 repair in 1.2.18 and the others is not repaired. Right?

If you are talking about this issue, there is no others.

Xumin-chen commented 4 months ago

I m talking about other officially released version.