Markus Koschany pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ec479a33 by Markus Koschany at 2023-04-18T22:40:56+02:00
CVE-2023-27585,asterisk: Buster is affected
The vulnerable code is shipped in debian/pjproject_2.12.1~dfsg.orig.tar.bz2 and
applied at build time. In the past the pjproject library has been packaged
separately. Debian's maintainer chose to embed it later.
- - - - -
1b52d3ba by Markus Koschany at 2023-04-18T22:40:56+02:00
LTS: add asterisk to dla-needed.txt
- - - - -
480c118b by Markus Koschany at 2023-04-18T22:40:56+02:00
Claim asterisk in dla-needed.txt
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -9774,7 +9774,6 @@ CVE-2023-27586 (CairoSVG is an SVG converter based on
Cairo, a 2D graphics libra
NOTE: Introduced in
https://github.com/Kozea/CairoSVG/commit/1ee0889f4015ebaddcf9976d43222e673155797c
(0.3)
CVE-2023-27585 (PJSIP is a free and open source multimedia communication
library writt ...)
- asterisk <unfixed>
- [buster] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
- ring <unfixed>
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
=====================================
data/dla-needed.txt
=====================================
@@ -26,6 +26,11 @@ apache2
NOTE: 20230312: Special attention: Double check an update! Package is used
by many customers and users!.
NOTE: 20230326: VCS: https://salsa.debian.org/apache-team/apache2. Yadd is
ok for using apache2 salsa tree
--
+asterisk (Markus Koschany)
+ NOTE: 20230418: Programming language: C.
+ NOTE: 20230418: VCS: https://salsa.debian.org/lts-team/packages/asterisk.git
+ NOTE: 20230418: Special attention: pjproject library is included in debian
directory!.
+--
cairosvg (dleidert)
NOTE: 20230323: Programming language: Python.
NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport
the --unsafe switch, introduced in 1.0.21, might work (dleidert)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
