Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2b181cd3 by Guilhem Moulin at 2023-01-28T22:57:33+01:00
Reserve DLA-3289-1 for dojo
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -149209,7 +149209,6 @@ CVE-2021-23451 (The package otp-generator before
3.0.0 are vulnerable to Insecur
CVE-2021-23450 (All versions of package dojo are vulnerable to Prototype
Pollution via ...)
- dojo 1.17.2+dfsg1-1 (bug #1014785)
[bullseye] - dojo 1.15.4+dfsg1-1+deb11u1
- [buster] - dojo <no-dsa> (Minor issue)
NOTE: https://github.com/advisories/GHSA-m8gw-hjpr-rjv7
NOTE: Fixed by:
https://github.com/dojo/dojo/commit/b7b8b279f3e082e9d4b54144fe831bdc77b2e0c9
CVE-2021-23449 (This affects the package vm2 before 3.9.4 via a Prototype
Pollution at ...)
@@ -229633,7 +229632,6 @@ CVE-2020-4052 (In Wiki.js before 2.4.107, there is a
stored cross-site scripting
NOT-FOR-US: Wiki.js
CVE-2020-4051 (In Dijit before versions 1.11.11, and greater than or equal to
1.12.0 ...)
- dojo 1.15.4+dfsg1-1 (bug #970000)
- [buster] - dojo <no-dsa> (Minor issue)
NOTE:
https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6
NOTE:
https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
CVE-2020-4045 (SSB-DB version 20.0.0 has an information disclosure
vulnerability. The ...)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[28 Jan 2023] DLA-3289-1 dojo - security update
+ {CVE-2020-4051 CVE-2021-23450}
+ [buster] - dojo 1.14.2+dfsg1-1+deb10u3
[28 Jan 2023] DLA-3288-1 curl - security update
{CVE-2022-27774 CVE-2022-32221 CVE-2022-35252 CVE-2022-43552}
[buster] - curl 7.64.0-4+deb10u4
=====================================
data/dla-needed.txt
=====================================
@@ -44,10 +44,6 @@ consul
NOTE: 20221031: Programming language: Go.
NOTE: 20221031: Concluded that the package should be fixed by the CVE
description. Source code not analyzed in detail.
--
-dojo (guilhem)
- NOTE: 20230105: Programming language: JavaScript.
- NOTE: 20230105: Follow fixes from bullseye 11.6 (Beuc/front-desk)
---
erlang
NOTE: 20221119: Programming language: Erlang.
NOTE: 20221119: at least CVE-2022-37026 needs to be fixed (original request
has been for Stretch)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b181cd333ea02a39a88d902391d99028c9c2790
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b181cd333ea02a39a88d902391d99028c9c2790
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
