CVE-2018-13844: High severity htslib vulnerability
Published Jul 10, 2018
·Updated
DISPUTED An issue has been found in HTSlib 1.8. It is a memory leak in fairead in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by faiload() in their own code.
Affected Software
1 affected component
HTSlib HTSlib=1.8
Event History
Jul 10, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Disputed
06:29 PM
Frequently Asked Questions
1
Is this issue considered a confirmed vulnerability in HTSlib itself?
No. Its status is disputed. The dispute states that the memory leak occurs in the test harness and that HTSlib users are expected to destroy the object returned by fai_load() in their own code.
2
What code should developers review to assess exposure?
Review code that calls fai_load() and ensure the returned object is destructed when it is no longer needed. The provided dispute indicates that failure to perform this cleanup in caller code is the relevant condition.