iotjs: CVE-2020-29657

Debian Bug report logs - #977736
iotjs: CVE-2020-29657

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: iotjs: CVE-2020-29657

Date: Sat, 19 Dec 2020 21:02:35 +0100

Source: iotjs
Version: 1.0+715-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/jerryscript-project/jerryscript/issues/4244
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.0-1

Hi,

The following vulnerability was published for iotjs. Actually for
embedded jerryscript, which seem still affected in up to the version
included in 1.0+715-1.

CVE-2020-29657[0]:
| In JerryScript 2.3.0, there is an out-of-bounds read in
| main_print_unhandled_exception in the main-utils.c file.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-29657
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29657
[1] https://github.com/jerryscript-project/jerryscript/issues/4244

Regards,
Salvatore

Message #14 received at 977736@bugs.debian.org (full text, mbox, reply):

From: Philippe Coval <rzr@users.sf.net>

To: Debian Bug Tracking System <977736@bugs.debian.org>

Subject: Re: iotjs: CVE-2020-29657 : False positive ?

Date: Thu, 07 Jan 2021 22:58:03 +0100

Package: iotjs
Followup-For: Bug #977736

Dear Maintainer,

As iotjs's Debian maintainer,
I have forwarded this issue to upstream tracker:

https://github.com/jerryscript-project/iotjs/issues/1955

But, It looks like that "main_print_unhandled_exception" function is in
jerryscript CLI program not in the library that iotjs link with

It can be easily verified using:

   readelf -Wsa /usr/bin/iotjs  | grep  print_

   610: 0000000000020030     1 FUNC    GLOBAL DEFAULT   14 print_stacktrace
   776: 000000000006afa0    16 FUNC    GLOBAL DEFAULT   14 jerry_port_print_char

So I think this scanner is a false positive.

I don't know if upstream iotjs plan to jerryscript soon
and IMHO, it is not worthy of backporting the related patch
because it wont be compiled.

Regards

Message #19 received at 977736@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: rzr@users.sf.net, 977736@bugs.debian.org

Cc: yadd@debian.org

Subject: Re: Bug#977736: iotjs: CVE-2020-29657 : False positive ?

Date: Sat, 9 Jan 2021 09:32:03 +0100

Control: severity -1 minor

Hi

On Thu, Jan 07, 2021 at 10:58:03PM +0100, Philippe Coval wrote:
> Package: iotjs
> Followup-For: Bug #977736
> 
> Dear Maintainer,
> 
> As iotjs's Debian maintainer,
> I have forwarded this issue to upstream tracker:
> 
> https://github.com/jerryscript-project/iotjs/issues/1955
> 
> But, It looks like that "main_print_unhandled_exception" function is in
> jerryscript CLI program not in the library that iotjs link with
> 
> It can be easily verified using:
> 
>    readelf -Wsa /usr/bin/iotjs  | grep  print_
> 
>    610: 0000000000020030     1 FUNC    GLOBAL DEFAULT   14 print_stacktrace
>    776: 000000000006afa0    16 FUNC    GLOBAL DEFAULT   14 jerry_port_print_char
> 
> So I think this scanner is a false positive.
> 
> I don't know if upstream iotjs plan to jerryscript soon
> and IMHO, it is not worthy of backporting the related patch
> because it wont be compiled.

Okay indeed, while it might affect the source code itself it seems not
for th binary package, in particular so as you found for the iotjs use
(and it does not compile main-utils.c).

I'm doing two things. Downgrade the severity to minor, I think the bug
just can be closed once upstream rebased the JerryScripts copy to the
version including the fix.

Marking it as unimportant in the security-tracker indicating it does
not affect at all the iotjs produced binary packages.

I do agree that there is  no sense in backporting the related patch to
iotjs.

Regards,
Salvatore

Send a report that this bug log contains spam.