Subject: Inquiry on CVE-2024-39689 Fix and Update Timeline

From: Siddharth Srivastava <[email-masked]>
Date: Tue, 6 Aug 2024 04:07:40 +0000

Dear Alpine Team,
I am writing to inquire about the fix for CVE-2024-39689 in Alpine Linux. Our team has noted that the current latest available version of alpine 3.20 is using py3-certifi 2024.2.2 version and is still affected by this vulnerability. Given the importance of maintaining security and stability in our systems, we are keen to update to a version that addresses this issue.
Could you kindly provide us with information on when the fix will be released and an estimated timeline for the availability of the updated version 2024.07.04?
Your prompt response would be greatly appreciated as it will help us in planning our update process accordingly.
Thank you for your attention to this matter.
Best regards,
Siddharth Srivastava

---

From: "lauren n. liberda" <[email-masked]>
Date: Tue, 6 Aug 2024 06:28:32 +0200

hi,

py3-certifi package in alpine is patched to return the path of 
ca-certificates, which distributes mozilla's CA bundle, and does not 
distribute its own root certificate list, so the version of py3-certifi 
does not matter.

the issue described in the CVE applies to the ca-certificates package 
though, where it's been fixed since version 20240705, shipped on 
2024-07-05 (see 
https://gitlab.alpinelinux.org/alpine/ca-certificates/-/commit/affc05d8b5483e39c66a41b80ee47e60951d94ef)

On 06-08-2024 06:07, Siddharth Srivastava wrote:
> Dear Alpine Team,
> I am writing to inquire about the fix for CVE-2024-39689 in Alpine 
> Linux. Our team has noted that the current latest available version of 
> alpine 3.20 is using py3-certifi 2024.2.2 version and is still 
> affected by this vulnerability. Given the importance of maintaining 
> security and stability in our systems, we are keen to update to a 
> version that addresses this issue.
> Could you kindly provide us with information on when the fix will be 
> released and an estimated timeline for the availability of the updated 
> version 2024.07.04?
> Your prompt response would be greatly appreciated as it will help us 
> in planning our update process accordingly.

-- 
lauren n. liberda
it/she, het/zij, to [coś]/ona
https://liberda.nl/