[PATCH 0/2] Fix CVE-2022-28391

Radoslav Kolev radoslav.kolev at suse.com
Tue Jul 19 15:53:30 UTC 2022


The following two patches fix CVE-2022-2839 preventing netstat,
traceroute and nslookup from sending escape sequences to the terminal.
Note that the problem is only reproducible when using musl libc, but 
not with glibc.

More information can be found at:
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661

Ariadne Conill (2):
  libbb: sockaddr2str: ensure only printable characters are returned for
    the hostname part
  nslookup: sanitize all printed strings with printable_string

 libbb/xconnect.c      |  5 +++--
 networking/nslookup.c | 10 +++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

-- 
2.26.2



More information about the busybox mailing list