eclipse-threadx/threadx

Question regarding vulnerability CVE-2023-48693

Opened this issue · 1 comments

bastreynard commented

Hello,
We are running ThreadX version 6.2.1 on products where a version bump is not possible (will bump for future products).

Would it be possible to know which commit/PR is responsible for fixing the remote code execution vulnerability, in order to be able to assess if we can patch it on earlier products on our end ?

Thank you for your support and have a great day,
Bastien

amgross commented

I guess it is about #307 (which BTW effects just threadx modules, in none module there is no privilege mechanism anyway)