CVE-2019-20446

---

mdeslaur

also affects older versions written in C The fixes added to 2.40.21 cause a regression, and upstream will not be fixing them.

---

rodrigo-zaiden

backporting the missing part of the fix from the 2.46 version (in Rust) to 2.40 (in C) is not trivial and requires an effort for someone involved in the project. as of 2022-11-25, there is no new commits in 2.40 branch.

---

ccdm94

upstream has released a fix for this issue, and also a new version containing said fix (2.40.21). Applying the patch recovered from version 2.40.21 caused a regression, as per launchpad bug 1889206, and there have been no additional commits in branch 2.40 in the last 2 years (last commit in 2020-02-26). In issue 612, upstream mentions that they will no longer provide fixes to branch 2.40. They also mention the fix to the regression, available for later versions of the code, but backporting it is not viable, as the code has been refactored and is now in an entirely different programming language. This mean there are no possible commits provided that would allow a fix for the regression in releases containing the C version of the code. Therefore, this issue will be marked as ignored for bionic and earlier.