Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
be116e88 by Salvatore Bonaccorso at 2019-11-19T19:33:46Z
Update information on CVE-2019-18886/symfony
Versions before 4.1.0 are not affected because the previous versions
asserts "the current user is granted to switch" BEFORE "loading
the
user".
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -531,8 +531,13 @@ CVE-2019-18886 [Prevent user enumeration using switch user
functionality]
RESERVED
{DLA-1999-1}
- symfony 4.3.8+dfsg-1
+ [buster] - symfony <not-affected> (Vulnerability introduced in 4.1.0)
+ [stretch] - symfony <not-affected> (Vulnerability introduced in 4.1.0)
NOTE:
https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality
- NOTE:
https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332
+ NOTE: Introduced by:
https://github.com/symfony/symfony/commit/6e6ac9eaeec9e6a6cc0ab003cac3738460542b0a
(v4.1.0-BETA1)
+ NOTE: Previous versions asserts "the current user is granted to switch"
BEFORE
+ NOTE: "loading the user" and thus are not affected.
+ NOTE: Fixed by:
https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332
(v4.2.12)
CVE-2019-18885 (fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a
btrfs_verif ...)
- linux 5.2.6-1
NOTE:
https://git.kernel.org/linus/09ba3bc9dd150457c506e4661380a6183af651c1 (5.1-rc1)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/be116e88b0760c40cdb952b0d9e26aece4c0315c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/be116e88b0760c40cdb952b0d9e26aece4c0315c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
