opensvc/multipath-tools 0.14.5

multipath-tools 0.14.5

on GitHub

Vulnerability fixes

• DoS on mulipathd socket by blocking IPC send operations
• DoS on multipathd socket by exhausting connections
• Heap Out-of-Bounds Read in Custom Format String Parser via Trailing %
• Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing
• kpartx: Heap Out-of-Bounds Read in GPT Header Validation
• Path traversal in device-mapper-multipath failed_wwids management
  
• libmpathpersist PRIN READ FULL STATUS parser — unbounded descriptor rewrite causes root heap overflow

Bug fixes

• When parsing the device-mapper table of a multipath device, the result for
  path arguments was not checked for NULL. This happens if the kernel
  returns an invalid table with missing path arguments. Fix it by adding
  a NULL check.
  Fixes #155,
  #156.