3

I am working on finding workaround for CVE-2022-29190 in my application.

My application makes use of telegraf.

It also states this:

Telegraf is written in Go and compiles into a single binary with no external dependencies.

When I read details of this CVE here, it says this CVE is due to Pion DTLS. Also, I find this, which mentions telegraf.

So I am a bit confused here. If telegraf has no dependencies(ie no Pion DTLS) then why is it mentioned on ubuntu site as culprit package?

What am I missing here?

1 Answer 1

7

with no external dependencies

What they mean is that they have no runtime dependencies. All dependencies are compiled into the binary. You don't need to install libpion-dtls, as it is shipped with Telegraf.

Telegraf updated Pion DTLS in this commit, which shipped in Telegraf 1.24.0. This version is not yet packaged for Ubuntu.

Sometimes the Ubuntu maintainers fix security issues in the package itself, independent from the upstream source code. However, that doesn't seem to have happened here.

5
  • Thanks. So updating telegraf to 1.24.0 should fix this CVE.
    – Mandroid
    Commented Apr 4 at 9:02
  • @Mandroid In production I would seriously consider using the 3rd party APT repository to keep the package installed and up to date. Commented Apr 4 at 16:33
  • @le3th4x0rbot In production I wouldn't recommend using APT for this purpose at all, in favor of getting binaries directly from upstream or building from source. Debian and Ubuntu are famous for always being out of date, so they are not what you want for timely security fixes
    – Dev
    Commented Apr 5 at 0:00
  • @Dev The publisher of Telegraf provides their own apt repo to install from which would be up to date always and not forgotten like a hand installed binary. docs.influxdata.com/telegraf/v1/install/… Commented Apr 5 at 2:03
  • 2
    @le3th4x0rbot Oops, missed that there was an official source. That would be preferable, yes
    – Dev
    Commented Apr 5 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .