Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 3aafdcc7 by Salvatore Bonaccorso at 2021-12-17T08:48:13+01:00 Update status for CVE-2021-43398/Crypto++ Mark for now unimportant, and asked upstream if they are going to ask MITRE for a REJECT. The current understanding of the issue (unless reporter follows up with a test program and test data) is that this is actually the expected behaviour. Link: https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222 - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -5879,11 +5879,10 @@ CVE-2021-43400 (An issue was discovered in gatt-database.c in BlueZ 5.61. A use- CVE-2021-43399 (The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-s ...) TODO: check CVE-2021-43398 (Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in ...) - - libcrypto++ <unfixed> (bug #1000227) - [bullseye] - libcrypto++ <no-dsa> (Minor issue) - [buster] - libcrypto++ <no-dsa> (Minor issue) - [stretch] - libcrypto++ <no-dsa> (Minor issue) + - libcrypto++ <unfixed> (unimportant; bug #1000227) NOTE: https://github.com/weidai11/cryptopp/issues/1080 + NOTE: As per upstream believed to be the expected behaviour: + NOTE: https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222 CVE-2021-43397 (LiquidFiles before 3.6.3 allows remote attackers to elevate their priv ...) NOT-FOR-US: LiquidFiles CVE-2021-43395 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3aafdcc77192235ca3873e07ee0668bf92c960fc -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3aafdcc77192235ca3873e07ee0668bf92c960fc You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
