# Racket v8.5 release thread
**URL:** https://racket.discourse.group/t/racket-v8-5-release-thread/841
**Category:** Internals
**Tags:** release-management
**Created:** [April 2, 2022, 12:38am UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841 "2022-04-02T00:38:02Z")
**Posts on this page:** 5
**Page:** 3
### Author:  [@robby](https://racket.discourse.group/u/robby)
#### Post date: [April 30, 2022, 5:06pm UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841/41 "2022-04-30T17:06:14Z")
> Here's my shortened attempt:
>
> ```
> Those who manually configure Racket CS to use Zlib compression for compiled code should be aware of CVE-2018-25032, which could potentially open the door to a host of attacks.
>
> ```
Here's an edit to consider:
"Those who manually configure Racket CS to use Zlib compression for compiled code should be aware of CVE-2018-25032; the next release and the current snapshot builds use a newer version of zlib."
---
### Author:  [@jbclements](https://racket.discourse.group/u/jbclements)
#### Post date: [April 30, 2022, 5:48pm UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841/42 "2022-04-30T17:48:03Z")
> [@robby](#):
>
> Those who manually configure Racket CS to use Zlib compression for compiled code should be aware of CVE-2018-25032; the next release and the current snapshot builds use a newer version of zlib.
Sounds good to me.
Ooh, have to get to 20 characters.
---
### Author:  [@plane](https://racket.discourse.group/u/plane)
#### Post date: [August 27, 2022, 1:09pm UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841/43 "2022-08-27T13:09:56Z")
> [@robby](#):
>
> "Those who manually configure Racket CS to use Zlib compression for compiled code should be aware of CVE-2018-25032; the next release and the current snapshot builds use a newer version of zlib."
It looks like there's also now [NVD - CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), which affects the updated zlib 1.2.12 (which is still the latest release).
---
### Author:  [@spdegabrielle](https://racket.discourse.group/u/spdegabrielle)
#### Post date: [August 27, 2022, 3:41pm UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841/44 "2022-08-27T15:41:59Z")
What is the normal approach?
If users identify this as a risk for them should they update zlib themselves and build from source until the next release?
(I’m guessing the last zlib update could be used as a guide? [Chez Scheme: update zlib to v1.2.12 · racket/racket@2100cea · GitHub](https://github.com/racket/racket/commit/2100ceafbb61930197176e97d41d1f9997338277) )
---
### Author:  [@LiberalArtist](https://racket.discourse.group/u/LiberalArtist)
#### Post date: [August 27, 2022, 6:28pm UTC](https://racket.discourse.group/t/racket-v8-5-release-thread/841/45 "2022-08-27T18:28:57Z")
> [@plane](#):
>
> It looks like there's also now [NVD - CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), which affects the updated zlib 1.2.12 (which is still the latest release).
At first glance, it doesn't look like `inflateGetHeader` is used in Chez Scheme. (It might be possible to get to it via `ffi/unsafe` functionality, but, if you can run unsafe Racket code, you can already do arbitrarily bad stuff.) However,
> [@spdegabrielle](#):
>
> What is the normal approach?
>
> If users identify this as a risk for them should they update zlib themselves and build from source until the next release?
>
> (I’m guessing the last zlib update could be used as a guide? [Chez Scheme: update zlib to v1.2.12 · racket/racket@2100cea · GitHub](https://github.com/racket/racket/commit/2100ceafbb61930197176e97d41d1f9997338277) )
In addition to the Zlib used by Chez Scheme, Zlib is also included on some platforms with the support libraries for `racket/draw`: see [Zlib for `racket/draw` affected by CVE-2018-25032 · Issue #4286 · racket/racket · GitHub](https://github.com/racket/racket/issues/4286).
I started working on a script at one point to check for CVEs during CI; I'll try to get back to that.
[Previous page](https://racket.discourse.group/t/racket-v8-5-release-thread/841.md?page=2)