Maniphest T2860

Update Accel-PPP to fix l2tp CVE
Closed, ResolvedPublicBUG
Actions

Assigned To

Authored By

	Dmitry
	Sep 6 2020, 7:34 AM

Tags

Referenced Files

None

Subscribers

Description

Need update accel-ppp to fix CVE related with a buffer overflow for l2TP AVP
Info: https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf
Fixed version https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b

Details

Difficulty level: Easy (less than an hour)
Version: 1.3-rolling-202009050118
Why the issue appeared?: Will be filled on close
Is it a breaking change?: Unspecified (possibly destroys the router)
Issue type: Security vulnerability

Event Timeline

Dmitry created this task.Sep 6 2020, 7:34 AM

PR https://github.com/vyos/vyos-build/pull/124

pasik added a subscriber: pasik.Sep 6 2020, 8:54 AM

Tested on 1.3-rolling-202009060846

c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus board.Nov 23 2020, 4:03 PM

erkin set Issue type to Security vulnerability.Aug 29 2021, 1:12 PM

erkin removed a subscriber: Active contributors.

syncer edited projects, added VyOS 1.3 Equuleus (1.3.0); removed VyOS 1.3 Equuleus.Aug 29 2022, 12:26 PM

syncer moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.0) board.