From: Dor Hayun <dor.hayun@whitesourcesoftware.com>
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.100.2.1.4\))
Subject: Inquiry Regarding Security Status and CVE-2022-37434 for zlib in
 Alpine Linux 3.8
Message-Id: <6368BBD7-FDDE-4217-90B9-E9886F7ECFA2@whitesourcesoftware.com>
Date: Tue, 17 Oct 2023 10:37:20 +0300
To: ~alpine/users@lists.alpinelinux.org



Dear Alpine Linux Team,

I trust this message finds you well. My name is Dor, and I am reaching =
out with a general inquiry about the security status of the zlib library =
in Alpine Linux version 3.8.

Recently, I have been working with a Docker image based on Alpine:3.8.5, =
and I observed that the zlib library version is reported as 1.2.11-r1. =
However, upon reviewing the Alpine Linux Security Advisories, I did not =
find any mention of CVE-2022-37434 for Alpine:3.8. It appears that the =
CVE has been addressed in Alpine Linux 3.11 and later versions.

To ensure a comprehensive understanding of the security posture of the =
zlib library in Alpine:3.8, I would appreciate it if you could shed some =
light on the following:

1. Is the zlib library in Alpine:3.8 considered not vulnerable to =
CVE-2022-37434? If so, could you provide some insights into the reasons =
behind this?

2. Are there plans to address this CVE specifically for Alpine:3.8, or =
has it been determined that the library in this version is not affected?

I believe that clarifying these points would be valuable not only for my =
use case but also for others in the community who may be working with =
Alpine:3.8 in their environments.

If possible, could you also provide an example or guidance on how users =
can verify the security status of a specific library in an Alpine Linux =
version to promote transparency and informed decision-making?

I appreciate your time and efforts in maintaining the security integrity =
of Alpine Linux. Thank you for your attention to this matter.

Best regards,

Dor H.=