Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 2fd1d388 by Salvatore Bonaccorso at 2021-02-15T05:55:59+01:00 Revert "mark CVE-2020-17525 as not-affected for subversion" This reverts commit a2368bbbf02e0ebb4ff1cf2e72d8642c81e14623. Upstream states at https://subversion.apache.org/security/CVE-2020-17525-advisory.txt that all versions in the 1.9.x series are affected as well. But in fact there waere major code refactoring. The missing checking in older versions seem to be missing in the get_repos_config() in the libsvn_repos/config_pool.c instead of libsvn_repos/config_file.c. That said, though please verify again my above comment and in case it turns to be wrong, just revert again this revert, but I wanted to play on safe side. - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -49720,7 +49720,6 @@ CVE-2020-17525 [Remote unauthenticated denial-of-service in Subversion mod_authz RESERVED {DSA-4851-1} - subversion 1.14.1-1 (bug #982464) - [stretch] - subversion <not-affected> (Vulnerable code not present) NOTE: https://subversion.apache.org/security/CVE-2020-17525-advisory.txt CVE-2020-17524 REJECTED View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fd1d388608912e77f5d28bc11e5998b12c91417 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fd1d388608912e77f5d28bc11e5998b12c91417 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
