Message-ID: <8a303077-8e0d-407a-bfbc-7f361f38593c@selfisekai.rocks>
Date: Tue, 6 Aug 2024 06:28:32 +0200
MIME-Version: 1.0
Subject: Re: Inquiry on CVE-2024-39689 Fix and Update Timeline
To: ~alpine/users@lists.alpinelinux.org
References: <DS0PR10MB6149F8CED4DC162A27A41793A3BF2@DS0PR10MB6149.namprd10.prod.outlook.com>
Content-Language: en-US
From: "lauren n. liberda" <lauren@selfisekai.rocks>
Autocrypt: addr=lauren@selfisekai.rocks; keydata=
 xjMEZds86BYJKwYBBAHaRw8BAQdAXg2C2CwsO1IHJM0JbZFSsj0Qsaqy5KHVeq7Dwj+WmHPN
 QmxhdXJlbiBuLiBsaWJlcmRhIChwb3N0IDIwMjQtMDItMTUgcmFpZCkgPGxhdXJlbkBzZWxm
 aXNla2FpLnJvY2tzPsKZBBMWCgBBFiEExNpmCD+2mk1lqoAGFhPdMv4ow+oFAmXbPOgCGwMF
 CQWjmoAFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQFhPdMv4ow+ospgEA/zaaNnPE
 xGRowVjOyVCokA73LOCofGY/Ny4BF2QhWy8BAPfF/V55hT5IippOI56fxK+U0AOYMAfpcr/K
 xgePwQsAzjgEZds86BIKKwYBBAGXVQEFAQEHQD1inUwS+R0L22otAzbE10kLj8RIRZqPLIDW
 ifHz0V5dAwEIB8J+BBgWCgAmFiEExNpmCD+2mk1lqoAGFhPdMv4ow+oFAmXbPOgCGwwFCQWj
 moAACgkQFhPdMv4ow+qWSQD+MsP5I2Xjw0WKNj2Rps6YHhDKlKPbPCJYrcRWlfLEXAABAIWW
 q4f0t1R5GUrsPFgQsKbiwu0M6JSNpevDBlIa1UUN
In-Reply-To: <DS0PR10MB6149F8CED4DC162A27A41793A3BF2@DS0PR10MB6149.namprd10.prod.outlook.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

hi,


py3-certifi package in alpine is patched to return the path of 
ca-certificates, which distributes mozilla's CA bundle, and does not 
distribute its own root certificate list, so the version of py3-certifi 
does not matter.


the issue described in the CVE applies to the ca-certificates package 
though, where it's been fixed since version 20240705, shipped on 
2024-07-05 (see 
https://gitlab.alpinelinux.org/alpine/ca-certificates/-/commit/affc05d8b5483e39c66a41b80ee47e60951d94ef)


On 06-08-2024 06:07, Siddharth Srivastava wrote:
> Dear Alpine Team,
> I am writing to inquire about the fix for CVE-2024-39689 in Alpine 
> Linux. Our team has noted that the current latest available version of 
> alpine 3.20 is using py3-certifi 2024.2.2 version and is still 
> affected by this vulnerability. Given the importance of maintaining 
> security and stability in our systems, we are keen to update to a 
> version that addresses this issue.
> Could you kindly provide us with information on when the fix will be 
> released and an estimated timeline for the availability of the updated 
> version 2024.07.04?
> Your prompt response would be greatly appreciated as it will help us 
> in planning our update process accordingly.
> Thank you for your attention to this matter.
> Best regards,
> Siddharth Srivastava

-- 
lauren n. liberda
it/she, het/zij, to [coś]/ona
https://liberda.nl/