CVE-2025-30472
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_conv...
Original description
The description as published by the source.
Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-30472 corosync Fixed in: 3.1.2-2+deb11u1
References
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web corosync.org
- web github.com
- web lists.debian.org