Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
27e598cb by Moritz Muehlenhoff at 2020-05-14T22:41:24+02:00
new libspring-security-2.0-java, glpi issues
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -18537,13 +18537,13 @@ CVE-2020-5579
 CVE-2020-5578
        RESERVED
 CVE-2020-5577 (Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier 
(Movabl ...)
-       TODO: check
+       - movabletype-opensource <removed>
 CVE-2020-5576 (Cross-site request forgery (CSRF) vulnerability in Movable Type 
series ...)
-       TODO: check
+       - movabletype-opensource <removed>
 CVE-2020-5575 (Cross-site scripting vulnerability in Movable Type series 
(Movable Typ ...)
-       TODO: check
+       - movabletype-opensource <removed>
 CVE-2020-5574 (HTML attribute value injection vulnerability in Movable Type 
series (M ...)
-       TODO: check
+       - movabletype-opensource <removed>
 CVE-2020-5573
        RESERVED
 CVE-2020-5572
@@ -18934,9 +18934,9 @@ CVE-2020-5410
 CVE-2020-5409 (Pivotal Concourse, most versions prior to 6.0.0, allows 
redirects to u ...)
        NOT-FOR-US: Pivotal
 CVE-2020-5408 (Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 
5.2.4, 5 ...)
-       TODO: check
+       - libspring-security-2.0-java <removed>
 CVE-2020-5407 (Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior 
to 5.3.2 ...)
-       TODO: check
+       - libspring-security-2.0-java <removed>
 CVE-2020-5406 (VMware Tanzu Application Service for VMs, 2.6.x versions prior 
to 2.6. ...)
        NOT-FOR-US: VMware
 CVE-2020-5405 (Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 
2.1.x pri ...)
@@ -19351,7 +19351,10 @@ CVE-2020-5249 (In Puma (RubyGem) before 4.3.3 and 
3.12.4, if an application usin
        NOTE: 
https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
        NOTE: 
https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
 CVE-2020-5248 (GLPI before before version 9.4.6 has a vulnerability involving 
a defau ...)
-       TODO: check
+       - glpi <removed> (unimportant)
+       NOTE: Only supported behind an authenticated HTTP zone
+       NOTE: 
https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9
+       NOTE: 
https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
 CVE-2020-5247 (In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an 
application us ...)
        - puma 3.12.4-1 (bug #952766)
        NOTE: 
https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
@@ -22173,7 +22176,7 @@ CVE-2020-4094
 CVE-2020-4093
        RESERVED
 CVE-2020-4092 ("If port encryption is not enabled on the Domino Server, HCL 
Nomad on  ...)
-       TODO: check
+       NOT-FOR-US: HCL Nomad
 CVE-2020-4091
        RESERVED
 CVE-2020-4090
@@ -28169,35 +28172,35 @@ CVE-2020-2009 (An external control of filename 
vulnerability in the SD WAN compo
 CVE-2020-2008 (An OS command injection and external control of filename 
vulnerability ...)
        NOT-FOR-US: PAN-OS
 CVE-2020-2007 (An OS command injection vulnerability in the management server 
compone ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2006 (A stack-based buffer overflow vulnerability in the management 
server c ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2005 (A cross-site scripting (XSS) vulnerability exists when visiting 
malici ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2004 (Under certain circumstances a user's password may be logged in 
clearte ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2003 (An external control of filename vulnerability in the command 
processin ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2002 (An authentication bypass by spoofing vulnerability exists in 
the authe ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2001 (An external control of path and data vulnerability in the Palo 
Alto Ne ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-2000
        RESERVED
 CVE-2020-1999
        RESERVED
 CVE-2020-1998 (An improper authorization vulnerability in PAN-OS that 
mistakenly uses ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1997 (An open redirection vulnerability in the GlobalProtect 
component of Pa ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1996 (A missing authorization vulnerability in the management server 
compone ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1995 (A NULL pointer dereference vulnerability in Palo Alto Networks 
PAN-OS  ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1994 (A predictable temporary file vulnerability in PAN-OS allows a 
local au ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1993 (The GlobalProtect Portal feature in PAN-OS does not set a new 
session  ...)
-       TODO: check
+       NOT-FOR-US: PAN-OS
 CVE-2020-1992 (A format string vulnerability in the Varrcvr daemon of PAN-OS 
on PA-70 ...)
        NOT-FOR-US: Palo Alto Networks
 CVE-2020-1991 (An insecure temporary file vulnerability in Palo Alto Networks 
Traps a ...)
@@ -30401,7 +30404,7 @@ CVE-2019-19104 (The web server in ABB Telephone Gateway 
TG/S 3.2 and Busch-Jaege
 CVE-2019-19103
        RESERVED
 CVE-2019-19102 (A directory traversal vulnerability in SharpZipLib used in the 
upgrade ...)
-       TODO: check
+       NOT-FOR-US: B&R Automation Studio
 CVE-2019-19101 (A missing secure communication definition and an incomplete 
TLS valida ...)
        NOT-FOR-US: B&R Automation Studio
 CVE-2019-19100 (A privilege escalation vulnerability in the upgrade service in 
B&amp;R ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e598cbe899e2fa3fd7103f5c2a8831d447987c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27e598cbe899e2fa3fd7103f5c2a8831d447987c
You're receiving this email because of your account on salsa.debian.org.


_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

Reply via email to