DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 60NB3cK82928298
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DFFBD4BA2E21
MIME-Version: 1.0
References: <BN9P111MB2434F33C607CDE0AB042906EB097A AT BN9P111MB2434 DOT NAMP111 DOT PROD DOT OUTLOOK DOT COM>
 <6040d6ad-9d19-4f1b-9a0b-f8b379175830 AT gmail DOT com>
 <87v7gtsfpl DOT fsf AT Gerda DOT invalid>
 <2b687296-0fbd-4b48-867a-0ac8ce38be82 AT gmail DOT com>
 <18d758ba-fa32-46b4-8948-b7b448e52d05 AT SystematicSW DOT ab DOT ca>
In-Reply-To: <18d758ba-fa32-46b4-8948-b7b448e52d05@SystematicSW.ab.ca>
Date: Fri, 23 Jan 2026 12:02:32 +0100
Message-ID: <CAB8Xom8epGnfoFs7LMQAmCuMcobVa5ykeaH_R3Xvei001JVmsA@mail.gmail.com>
Subject: Re: CVE-2025-13151 and Cygwin package libtasn1_6
To: The Cygwin Mailing List <cygwin AT cygwin DOT com>
From: marco atzeri via Cygwin <cygwin AT cygwin DOT com>
Reply-To: marco atzeri <marco DOT atzeri AT gmail DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

On Fri, 23 Jan 2026, 10:22 Brian Inglis via Cygwin, <cygwin AT cygwin DOT com>
wrote:

> On 2026-01-22 13:30, Marco Atzeri via Cygwin wrote:
> > On 22/01/2026 18:46, ASSI via Cygwin wrote:
> >> Marco Atzeri via Cygwin writes:
> >>> On 22/01/2026 17:50, FOPPE, JEFFREY B CIV USAF AFMC AFLCMC/WFRQ via
> >>> Cygwin wrote:
> >>>> CVE-2025-13151 points out a vulnerability in libtasn1 versions 4.20
> >>>> and earlier.  The version provided through Cygwin is much earlier.
> >>>> It doesn't look like this package has been updated since 2019 and is
> >>>> listed as Orphaned.  A lot of other packages seem to depend on it.
> >>>> Does anyone know if a developer will look at updating this?
> >>
> >>> Looking on it
> >>
> >> It looks like it'll be a few more days before the release is done
> >> upstream.
>
> > My understanding is that 4.21.0 is safe from this
> >
> > https://lists.gnu.org/archive/html/help-libtasn1/2026-01/msg00001.html
> >
> > I am testing the package build on Scallywag
> > https://cygwin.com/cgi-bin2/jobs.cgi
> >
> > Locally it passed all tests.
>
> Could also do with an update to gnutls 3.8.11?
>

I will look during weekend

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple