Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
db6b816a by Salvatore Bonaccorso at 2023-02-28T21:37:36+01:00
Clarify status for CVE-2016-10127
Note that back then the scope of the CVE was redefined. The commit added
is covered by CVE-2016-10149 and CVE-2016-10127 remained open. The scope
is broader and a fix would need to be implemented in libxml2.
Still back then there was confusion between scopes of CVE-2016-10127 and
CVE-2016-10149 so let's move it to negligible impact for the remaining
issue.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -397284,14 +397284,11 @@ CVE-2016-10126 (Splunk Web in Splunk Enterprise
5.0.x before 5.0.17, 6.0.x befor
CVE-2016-10125 (D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a
hardcoded ...)
NOT-FOR-US: D-Link
CVE-2016-10127 (PySAML2 allows remote attackers to conduct XML external entity
(XXE) a ...)
- - python-pysaml2 4.5.0-2 (low; bug #859135)
- [stretch] - python-pysaml2 <no-dsa> (Minor issue)
- [jessie] - python-pysaml2 <no-dsa> (Minor issue)
+ - python-pysaml2 <unfixed> (unimportant; bug #859135)
NOTE: https://github.com/rohe/pysaml2/issues/366
NOTE: A proper fix for this issue would be to fix the underlying issue
in src:libxml2
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1411794#c12
NOTE: https://www.openwall.com/lists/oss-security/2017/01/19/5 (for the
scope of the CVE)
- NOTE: https://github.com/IdentityPython/pysaml2/commit/6e09a25d9
(4.4.0-1)
CVE-2016-10149 (XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and
earlier a ...)
{DSA-3759-1}
- python-pysaml2 3.0.0-5 (bug #850716)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/db6b816a5a70e0f4d813eb406665b5ff1c8b5263
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/db6b816a5a70e0f4d813eb406665b5ff1c8b5263
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
