Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7508b85c by Chris Lamb at 2023-09-11T12:44:23-07:00
Reserve DLA-3561-1 for node-cookiejar
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -111139,7 +111139,6 @@ CVE-2022-25902
CVE-2022-25901 (Versions of the package cookiejar before 2.1.4 are vulnerable
to Regul ...)
- node-cookiejar 2.1.4+~2.1.2-1
[bullseye] - node-cookiejar 2.1.2-1+deb11u1
- [buster] - node-cookiejar <postponed> (Minor issue, ReDoS)
NOTE: https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
NOTE: https://github.com/bmeck/node-cookiejar/pull/39
NOTE:
https://github.com/bmeck/node-cookiejar/commit/a9a320c3c49d65df491f5721969cfbf9e128d9af
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[11 Sep 2023] DLA-3561-1 node-cookiejar - security update
+ {CVE-2022-25901}
+ [buster] - node-cookiejar 2.0.1-1+deb10u1
[10 Sep 2023] DLA-3560-1 libraw - security update
{CVE-2020-22628}
[buster] - libraw 0.19.2-2+deb10u4
=====================================
data/dla-needed.txt
=====================================
@@ -123,10 +123,6 @@ nasm
NOTE: 20230907: Added due to CVE-2020-18780, CVE-2020-21685 & CVE-2020-21686,
NOTE: 20230907: but some of these may require some investigation. (lamby)
--
-node-cookiejar (Chris Lamb)
- NOTE: 20230907: Added by Front-Desk (lamby)
- NOTE: 20230907: CVE-2022-25901 was ignored & now fixed in bullseye; patch
easy to backport. (lamby)
---
nova
NOTE: 20230302: Re-add, request by maintainer (Beuc)
NOTE: 20230302: zigo says that DLA 3302-1 ships a buster-specific
CVE-2022-47951 backport that introduces regression
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7508b85c9e4739e13a2a4f3869111df1cdf8b068
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7508b85c9e4739e13a2a4f3869111df1cdf8b068
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
