← Back to issue list

Update PyNaCl and libsodium

View original Github issue

Metadata

Project
snapcraft
Number
#5968
Type
issue
State
closed
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Resolved by merged PR #6011 (commit a8213b7ce), which ignored GHSA-mrfv-m5wm-5w6w because the PyNaCl/libsodium vulnerability was already patched in the build environment.

Resolution: closed resolved

Reason: PR #6011 merged as commit a8213b7ce and added the already-patched PyNaCl CVE to the ignore list. The maintainer subsequently marked #5968 as fixed in #6011.

Evaluated by: mr-cal-bot

No scores available.

Issue body

### Check existing issues - [x] I've verified that this request isn't described by any existing issues. ### Request We need to update PyNaCl and libsodium. libsodium was patched in noble for this vulnerability (https://packages.ubuntu.com/noble/libsodium23). However, the CVE is tied to PyNaCl. ### The problem it solves To resolve https://osv.dev/vulnerability/GHSA-mrfv-m5wm-5w6w.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Resolved by merged PR #6011 (commit a8213b7ce), which ignored GHSA-mrfv-m5wm-5w6w because the PyNaCl/libsodium vulnerability was already patched in the build environment.
stealth/space-bunny-alpha — closed resolved Resolved in merged PR #6011 (a8213b7ce) by suppressing GHSA-mrfv-m5wm-5w6w because Noble already ships a patched libsodium.
stealth/space-bunny-alpha — closed resolved Closed by merged PR #6011 (commit a8213b7ce), which suppressed the already-patched PyNaCl/libsodium CVE GHSA-mrfv-m5wm-5w6w.
stealth/space-bunny-alpha — closed resolved Resolved by merged PR canonical/snapcraft#6011, which added commit a8213b7ce to ignore GHSA-mrfv-m5wm-5w6w because Noble's libsodium23 patch makes PyNaCl exposure non-exploitable.
qwen/qwen3.6-35b-a3b — — Updated PyNaCl and libsodium to resolve CVE GHSA-mrfv-m5wm-5w6w. The fix was merged via pull request #6011.
qwen/qwen3.6-35b-a3b — — Updated PyNaCl and libsodium to resolve CVE GHSA-mrfv-m5wm-5w6w. The request was fixed and merged in pull request #6011.
qwen/qwen3.6-35b-a3b — — Updated PyNaCl and libsodium to resolve CVE GHSA-mrfv-m5wm-5w6w. The security fix was merged in pull request #6011, closing the request.
qwen3.6-35b-a3b-mtp-q6 — — Updated PyNaCl and libsodium to resolve CVE GHSA-mrfv-m5wm-5w6w. The request was fixed and merged via pull request #6011.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: canonical/snapcraft#6011 (confidence 100%)

    Merged PR #6011, commit a8213b7ce, directly resolved the reported vulnerability finding.

Related issues

Issue Project State Summary Similarity
#6011 build: fix CVEs snapcraft merged Merged #6011 (commit a8213b7ce), fixing #5968 by ignoring the already patched PyNaCl/libsodium CVE and updating pip and protobuf for two other CVEs.
73%