DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 60N9MBix2892802
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 2B3804BA23C1
Message-ID: <18d758ba-fa32-46b4-8948-b7b448e52d05@SystematicSW.ab.ca>
Date: Fri, 23 Jan 2026 02:21:47 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: CVE-2025-13151 and Cygwin package libtasn1_6
Content-Language: en-CA
To: cygwin@cygwin.com
References: <BN9P111MB2434F33C607CDE0AB042906EB097A@BN9P111MB2434.NAMP111.PROD.OUTLOOK.COM>
 <6040d6ad-9d19-4f1b-9a0b-f8b379175830@gmail.com>
 <87v7gtsfpl.fsf@Gerda.invalid>
 <2b687296-0fbd-4b48-867a-0ac8ce38be82@gmail.com>
Organization: Systematic Software
In-Reply-To: <2b687296-0fbd-4b48-867a-0ac8ce38be82@gmail.com>
Precedence: list
From: Brian Inglis via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Brian Inglis <Brian.Inglis@SystematicSW.ab.ca>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On 2026-01-22 13:30, Marco Atzeri via Cygwin wrote:
> On 22/01/2026 18:46, ASSI via Cygwin wrote:
>> Marco Atzeri via Cygwin writes:
>>> On 22/01/2026 17:50, FOPPE, JEFFREY B CIV USAF AFMC AFLCMC/WFRQ via
>>> Cygwin wrote:
>>>> CVE-2025-13151 points out a vulnerability in libtasn1 versions 4.20
>>>> and earlier.  The version provided through Cygwin is much earlier.
>>>> It doesn't look like this package has been updated since 2019 and is
>>>> listed as Orphaned.  A lot of other packages seem to depend on it.
>>>> Does anyone know if a developer will look at updating this?
>>
>>> Looking on it
>>
>> It looks like it'll be a few more days before the release is done
>> upstream.

> My understanding is that 4.21.0 is safe from this
> 
> https://lists.gnu.org/archive/html/help-libtasn1/2026-01/msg00001.html
> 
> I am testing the package build on Scallywag
> https://cygwin.com/cgi-bin2/jobs.cgi
> 
> Locally it passed all tests.

Could also do with an update to gnutls 3.8.11?

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retrancher  but when there is no more to cut
                                 -- Antoine de Saint-Exupéry

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple