Subject: Re: Inquiry Regarding Security Status and CVE-2022-37434 for zlib in Alpine Linux 3.8

From: Dor Hayun <[email-masked]>
Date: Tue, 17 Oct 2023 11:08:35 +0300

Hi,

You are correct, but we simply need to understand whether it is vulnerable or not. Why does it only appear for these branches and not below?

https://security.alpinelinux.org/vuln/CVE-2022-37434

---

From: Natanael Copa <[email-masked]>
Date: Tue, 17 Oct 2023 10:49:05 +0200

On Tue, 17 Oct 2023 11:08:35 +0300
Dor Hayun <[email-masked]> wrote:

> Hi,
> 
> You are correct, but we simply need to understand whether it is
> vulnerable or not. Why does it only appear for these branches and not
> below?
> 

Because at the time the secfixes-tracker was written (initial commit is
March 2021)[1], alpine 3.8 was already out of support[2] (EOL was
2020-05-01).

I suppose nobody cared enough to import historical data for releases
that were already out of support.

[1]: https://gitlab.alpinelinux.org/alpine/security/secfixes-tracker/-/commit/1fd953e3c1e9c0d9334ebfc5210e180b840ad5ba
[2]: https://alpinelinux.org/releases/

---

From: Unicorn <[email-masked]>
Date: Tue, 17 Oct 2023 10:40:56 +0200 (GMT+02:00)

> https://security.alpinelinux.org/vuln/CVE-2022-37434
Hi Dor,

this is probably because releases are supported for 2 years and 3.13 was 
still supported at the time of this vulnerability, while 3.8 has not been 
supported since 2020-05-01.

Best,
Edin