Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: d82b6717 by Salvatore Bonaccorso at 2020-02-26T23:07:57+01:00 Update references for CVE-2020-5398 https://pivotal.io/security/cve-2020-5398 refers to https://github.com/spring-projects/spring-framework/issues/24220 . An application is vulnerable when a set of condition is fulfilled, including when the filename is derived from user supplied input, which is not sanitized. - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -8952,8 +8952,9 @@ CVE-2020-5399 (Cloud Foundry CredHub, versions prior to 2.5.10, connects to a My CVE-2020-5398 (In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x pri ...) - libspring-java <unfixed> NOTE: https://pivotal.io/security/cve-2020-5398 - NOTE: https://github.com/spring-projects/spring-framework/issues/24238 - NOTE: https://github.com/spring-projects/spring-framework/commit/f9c1565f4ef031904c3545a70e63080aeade6e90 + NOTE: https://github.com/spring-projects/spring-framework/issues/24220 + NOTE: https://github.com/spring-projects/spring-framework/commit/41f40c6c229d3b4f768718f1ec229d8f0ad76d76 + NOTE: https://github.com/spring-projects/spring-framework/commit/956ffe68587c8d5f21135b5ce4650af0c2dea933 CVE-2020-5397 (Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF ...) - libspring-java <unfixed> [jessie] - libspring-java <not-affected> (Vulnerable code not present) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d82b671707fbe81d6d5447ea70c7a0b9edbbec91 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d82b671707fbe81d6d5447ea70c7a0b9edbbec91 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
