Re: Status of CVE-2018-19217

[Sylvain Beucler]

Hi,

On 16/04/2019 00:54, Thomas Dickey wrote:
> On Mon, Apr 15, 2019 at 12:23:28PM +0200, Sylvain Beucler wrote:
>> As part of the Debian LTS project I'm triaging active ncurses
>> vulnerabilities.
>>
>> For CVE-2018-19217, it seems nobody is able to reproduce the bug:
>> "In ncurses 6.1, there is a NULL pointer dereference at the function
>> _nc_name_match that will lead to a denial of service attack."
>> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19217
>> https://bugzilla.redhat.com/show_bug.cgi?id=1643753
>>
>> I myself couldn't find a 6.1 version that crashes on this POC.
>> It was never properly reported to the ncurses project itself, so I'm
>> doing that now.
>>
>> Do you consider this bug valid?
> no - it was reported in the wrong place, and I was unable to reproduce it.
>
>> If not, I can request a rejection of this CVE.
> sounds good
MITRE now marks it as "** DISPUTED **".
Not much more I can do AFAIK.

Thanks!
- Sylvain