[PATCH 0/2] Fix CVE-2022-28391
Radoslav Kolev
radoslav.kolev at suse.com
Tue Jul 19 15:53:30 UTC 2022
The following two patches fix CVE-2022-2839 preventing netstat,
traceroute and nslookup from sending escape sequences to the terminal.
Note that the problem is only reproducible when using musl libc, but
not with glibc.
More information can be found at:
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661
Ariadne Conill (2):
libbb: sockaddr2str: ensure only printable characters are returned for
the hostname part
nslookup: sanitize all printed strings with printable_string
libbb/xconnect.c | 5 +++--
networking/nslookup.c | 10 +++++-----
2 files changed, 8 insertions(+), 7 deletions(-)
--
2.26.2
More information about the busybox
mailing list