Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ae9be3c3 by Salvatore Bonaccorso at 2023-05-18T21:46:12+02:00
Update information for CVE-2023-29827/node-ejs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5339,9 +5339,10 @@ CVE-2023-29829
CVE-2023-29828
RESERVED
CVE-2023-29827 (ejs v3.1.9 is vulnerable to server-side template injection. If
the ejs ...)
- - node-ejs <unfixed>
+ - node-ejs <unfixed> (unimportant)
NOTE: https://github.com/mde/ejs/issues/720
- TODO: unlcear upstream status, details asked in
https://github.com/mde/ejs/issues/720#issuecomment-1535856360
+ NOTE: Not considered a security issue by upstream, requires to never
give unfiltered
+ NOTE: input to the EJS's render function.
CVE-2023-29826
RESERVED
CVE-2023-29825
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae9be3c3485ffb8f50bdc96419b62adf5588cfb3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae9be3c3485ffb8f50bdc96419b62adf5588cfb3
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
