Withdrawal of CVE-2020-24979: Impact on Bison Package in Alpine Linux
Summary
ALPINE-CVE-2020-24979: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Affects bison versions < 3.7.2-r0. Fixed in 3.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bison is a parser generator that is widely used in software development to convert a formal grammar into a C program that parses that grammar. It is a critical tool for developers, providing functionality to create parsers for various programming languages. The Bison package is included in multiple versions of Alpine Linux, which is a security-oriented, lightweight Linux distribution. The vulnerability in question was initially reported but later withdrawn, indicating that it was not a security issue.
Vulnerability Detail
CVE-2020-24979 was initially reported as a potential security vulnerability affecting the Bison package in Alpine Linux. However, further investigation revealed that this candidate number was withdrawn by its CNA, as it was determined that there was no actual security issue present. This highlights the importance of thorough vetting in vulnerability reporting, as false positives can lead to unnecessary concern and resource allocation.
How To Fix
Minimum fixed version
3.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade bisonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds are necessary for this vulnerability since it was determined not to be a security issue. Users are encouraged to ensure their systems are up to date with the latest package versions.
Conclusion
CVE-2020-24979 was a reported vulnerability affecting the Bison package in Alpine Linux, but it has been withdrawn after further investigation confirmed it was not a security issue. Users are encouraged to keep their software updated and utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for bison →
FAQ
CVE-2020-24979 was a candidate number assigned to a reported vulnerability in the Bison package for Alpine Linux, which was later withdrawn as it was found not to be a security issue.
Since the vulnerability was withdrawn, there is no impact on your use of Bison. You can continue using it without concern regarding this specific issue.
While there is no immediate need due to the withdrawal of the vulnerability, it is always recommended to keep your software packages updated to the latest versions for overall security and performance improvements.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
If you encounter a different vulnerability, it is advisable to report it to the relevant maintainers and follow best practices for securing your software environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for bison.
