CVE-2024-34391 and CVE-2024-34392

[macolmenerori]

A few days ago two vulnerabilities were listed:

• CVE-2024-34391
• CVE-2024-34392

Two issues where raised here and here respectively.

[ashishMsci]

Can we expect any fix for these vulnerabilities in near future?

[wiesjan]

Can we expect any fix for these vulnerabilities in near future?

I second that question 😉

[jkowalleck]

Hi, I am not affiliated with this project.
Still, I would highly encourage everybody waiting for a fix, to actively participate in the process. ... Given the maintenance posture of this project and its past as nearly-abandonware.

• You could pull-request a regression-test that showcases the vulnerability.
  Of course, this test will fail, as long as no fix was provided, but at least we could see that the claim is true: a vulnerability actually exists (this is important, because none of the CVE were analyzed/reviewed/proven).
• You could comment mitigation methods here.
• You could pullrequest a fix.
• just help improve the situation

If you (personally) cannot provide such, maybe the organizations you work for could pay somebody to help :-)