Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f7c70bcb by Salvatore Bonaccorso at 2023-08-22T22:49:38+02:00
Add CVE-2022-48570/libcrypto++
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -76,7 +76,11 @@ CVE-2022-48571 (memcached 1.6.7 allows a Denial of Service
via multi-packet uplo
- memcached 1.6.8+dfsg-1
NOTE: Fixed by:
https://github.com/memcached/memcached/commit/6b319c8c7a29e9c353dec83dc92f01905f6c8966
(1.6.8)
CVE-2022-48570 (Crypto++ through 8.4 contains a timing side channel in ECDSA
signature ...)
- TODO: check
+ - libcrypto++ <unfixed>
+ NOTE: https://github.com/weidai11/cryptopp/issues/992
+ NOTE: This issue exists because the CVE-2019-14318 fix was
intentionally removed for
+ NOTE: functionality reasons.
+ TODO: check details on upstream fix (in 8.4?)
CVE-2022-48566 (An issue was discovered in compare_digest in Lib/hmac.py in
Python thr ...)
TODO: check
CVE-2022-48565 (An XML External Entity (XXE) issue was discovered in Python
through 3. ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7c70bcb9e9fe0e16dcaf7de63978dd98973a60f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7c70bcb9e9fe0e16dcaf7de63978dd98973a60f
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
