medium
advisory
Samtools: Multiple security vulnerabilities
Multiple security vulnerabilities have been identified and addressed in samtools versions 1.24 and earlier, with patches now available in release 1.25 and backported versions.
Triage facts
Revision 1- Applicability
- samtools (<= 1.24)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 21:53 UTC
- Source quality
- A1Roughly even chance
Multiple vulnerabilities have been disclosed in the samtools package. The maintainers have released version 1.25 to address these issues. Backported fixes are also available in versions 1.24.1, 1.23.3, 1.22.4, and 1.21.3. CVE identifiers have not yet been assigned by the CVE naming authority and will be updated on the project's GitHub page upon assignment.
Recommendation
- Inventory all systems running samtools to identify versions 1.24 and earlier.
- Update samtools to version 1.25, or apply the relevant backported version (1.24.1, 1.23.3, 1.22.4, or 1.21.3) appropriate for your environment.
Mitigations
Upgrade samtools to version 1.25 or apply backported versions 1.24.1, 1.23.3, 1.22.4, or 1.21.3
immediate
IT Operations
All instances of samtools <= 1.24