CVE-2018-13843: High severity htslib vulnerability
Published Jul 10, 2018
·Updated
DISPUTED An issue has been found in HTSlib 1.8. It is a memory leak in bgzfgetline in bgzf.c. NOTE: the software maintainer's position is that the "failure to free memory" can be fixed in applications that use the HTSlib library (such as test/testbgzf.c in the original report) and is not a library issue.
Affected Software
1 affected component
HTSlib HTSlib=1.8
Remediation
Event History
Jul 10, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Disputed
06:29 PM
Frequently Asked Questions
1
Is this considered a confirmed defect in HTSlib itself?
No. The CVE is disputed, and the HTSlib maintainer states that the failure to free memory can be corrected by applications using the library rather than requiring a library-side fix.
2
What is the practical mitigation if updating is not immediately possible?
Review application code that calls bgzf_getline and ensure memory allocated or returned during its use is freed appropriately. The original report's test/test_bgzf.c is cited as an example where the application can make this correction.