[Debian-iot-maintainers] Bug#1061704: libcoap3: CVE-2024-0962

[Salvatore Bonaccorso]

Source: libcoap3
Version: 4.3.4-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/obgm/libcoap/issues/1310
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libcoap3.

CVE-2024-0962[0]:
| A vulnerability was found in obgm libcoap 4.3.4. It has been rated
| as critical. Affected by this issue is the function get_split_entry
| of the file src/coap_oscore.c of the component Configuration File
| Handler. The manipulation leads to stack-based buffer overflow. The
| attack may be launched remotely. The exploit has been disclosed to
| the public and may be used. It is recommended to apply a patch to
| fix this issue. VDB-252206 is the identifier assigned to this
| vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-0962
    https://www.cve.org/CVERecord?id=CVE-2024-0962
[1] https://github.com/obgm/libcoap/issues/1310
[2] https://github.com/obgm/libcoap/pull/1311
[3] https://github.com/obgm/libcoap/commit/2b28d8b0e9607e71a145345b4fe49517e052b7d9

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore