Compilers & proof tools security incidents and patch status

Today's specials

Nobody has a patch. Unplug things.

Rocq Prover10 h Rocq: soundness bug public PoCmedium severity
Do now Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet. Advisory
Re-scored 26 Oct ~~critical~~ → medium KEV – Record ✓ Vendor ✓
Rocq Prover11 h Rocq: soundness bug public PoCmedium severity
Do now Take Rocq proof checking offline or restrict who can submit proof files until the vendor's advisory names a fix, since no fix exists yet. Advisory
Re-scored 26 Oct ~~critical~~ → medium KEV – Record ✓ Vendor ✓

The fix exists. Somebody has to carry it.

Lean 411 h Leanprover lean4: vulnerability (public PoC) public PoCmedium severity
Fixed in 4.32.2 Advisory
Re-plated 26 Oct ~~On hold (status unknown)~~ → Half-poured (some lines fixed) KEV – Record ✓ Vendor ✓

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.