Hi Markus,
On Sun, Aug 01, 2021 at 05:53:55PM +0200, Salvatore Bonaccorso wrote:
> Hi Markus,
>
> On Sun, Aug 01, 2021 at 05:28:23PM +0200, Markus Koschany wrote:
> > On Wed, 28 Jul 2021 17:44:49 +0200 Salvatore Bonaccorso <[email protected]>
> > wrote:
> >
> > > Hi,
> > >
> > > The following vulnerability was published for apache-directory-server.
> > >
> > > CVE-2021-33900[0]:
> >
> >
> > Hi Salvatore,
> >
> > are you sure CVE-2021-33900 corresponds to apache-directory-server as well?
> > To
> > me it seems the vulnerability is in apache-directory-studio which is a
> > different Apache project
> >
> > https://github.com/apache/directory-studio/
> >
> > We haven't packaged that yet.
>
> I will have a look again (hopefully today) and come back to you again.
> Maybe this was a mistake, so I will recheck.
So aboslutely correct. The issue is in Apache Directory Studio. It
went from a error in tracking initially in 7adc1d9f0406
("CVE-2021-33900/apacheds") in the security-tracker repo, to fixing
the source package name in cff955e4f7e3 ("CVE-2021-33900: Track source
package name apache-directory-server") but without noticing the wrong
source package affected.
So, right, and closing this issue (and corrected along the
security-tracker tracking of CVE-2021-33900).
Regards,
Salvatore
