<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
No, I've not created a CVE previously, but I would be glad to help in whatever way I can.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Should we discuss the details off-list?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Jacob Henner</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> pybsddb <pybsddb-bounces@jcea.es> on behalf of Jesus Cea <jcea@jcea.es><br>
<b>Sent:</b> Wednesday, May 14, 2025 7:31 AM<br>
<b>To:</b> pybsddb@jcea.es <pybsddb@jcea.es><br>
<b>Subject:</b> Re: [pybsddb] Data leak in latest bsddb3/berkeleydb packages</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 14/5/25 3:49, Jacob Henner wrote:<br>
> Here is a simple reproducer:<br>
> <a href="https://gist.github.com/JacobHenner/8af2eeb7bfa29475aa203abcd526dccc">
https://gist.github.com/JacobHenner/8af2eeb7bfa29475aa203abcd526dccc</a><br>
> <br>
> The reproducer successfully reproduces the issue on Arch Linux amd64<br>
> with libdb 6.2.32 or libdb 5.3.28 and Python 3.12.10.<br>
> <br>
> Interestingly, the code segfaults with Python 3.13.3. I will create a<br>
> separate thread for that issue.<br>
<br>
I am talking (or trying) with Oracle about this issue. It is serious.<br>
<br>
Do you have experience creating a CVE?<br>
<br>
-- <br>
Jesús Cea Avión _/_/ _/_/_/ _/_/_/<br>
jcea@jcea.es - <a href="https://www.jcea.es/">https://www.jcea.es/</a> _/_/ _/_/ _/_/ _/_/ _/_/<br>
Twitter: @jcea _/_/ _/_/ _/_/_/_/_/<br>
jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/<br>
"Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/<br>
"My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/<br>
"El amor es poner tu felicidad en la felicidad de otro" - Leibniz<br>
</div>
</span></font></div>
</body>
</html>