samtools through 1.24 fixed in 1.25 and backports
Original title: Multiple vulnerabilities in samtools <= 1.24
Fixes were also back-ported to 1.24.1, 1.23.3, 1.22.4 and 1.21.3; CVE numbers are not assigned yet.
Robert Davies reported multiple vulnerabilities in the samtools package through version 1.24 on the oss-security list on October 27. All of the issues are fixed in release 1.25 and back-ported to 1.24.1, 1.23.3, 1.22.4 and 1.21.3. CVE identifiers are pending because GitHub, the assigning authority, has a backlog; the post points to GitHub pages that will be updated when IDs are issued. The feed snippet does not describe the individual flaws.
Unconfirmed: The snippet does not name the individual vulnerabilities, their impact, or whether they are exploited.
- Posted by Robert Davies on October 27.
- Affected range stated as samtools <= 1.24.
- Fixed in 1.25, 1.24.1, 1.23.3, 1.22.4 and 1.21.3.
- No CVE numbers yet because of a GitHub assignment backlog.
Impact: Multiple unspecified flaws in samtools
| Product | Affected | Fixed in |
|---|---|---|
| samtools | <= 1.24 | 1.25, 1.24.1, 1.23.3, 1.22.4, 1.21.3 |
- 1.Upgrade samtools to 1.25 or the listed back-ports 1.24.1, 1.23.3, 1.22.4 or 1.21.3.
From the original article
Posted by Robert Davies on Oct 27 Multiple vulnerabilities, listed below, have been disclosed in the samtools package. These have all been fixed in a new release 1. 25 and have also been pack-ported to versions 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.