Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Tue, 22 Oct 2024 14:40:44 +0000
Message-Id: <D52EVQDBDOAU.19UAE4XEVQLUZ@posteo.net>
Subject: Re: Inquiry Regarding Resolution Timeline for CVE-2022-38725 in
 "syslog-ng" Package
From: "Sertonix" <sertonix@posteo.net>
To: "Siddharth Srivastava" <siddharth.s.srivastava@oracle.com>,
 "~alpine/users@lists.alpinelinux.org" <~alpine/users@lists.alpinelinux.org>
References: <DS0PR10MB6149FEF0EB8BBF07DFFBB926A3432@DS0PR10MB6149.namprd10.prod.outlook.com>
In-Reply-To: <>

> Dear Alpine Security Team,
> Writing to inquire about the status of CVE-2022-38725, which affects the
> "syslog-ng" package in the 3.20-main branch. According to the Alpine
> Security Tracker, this CVE remains unresolved, and we are seeing it
> flagged in the latest images we are using. Could you please provide an
> update on when this vulnerability is expected to be resolved or if there
> are any planned fixes? T

The description of CVE-2022-38725 states that it effects syslog-ng version
3.0 through 3.37 but alpine doesn't ship these versions anymore.

I opened a MR to mark the CVE as fixed: https://gitlab.alpinelinux.org/alpi=
ne/aports/-/merge_requests/73944

> Thank you.
> Best regards,
> Siddharth Srivastava