Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
26ad789f by Sylvain Beucler at 2024-09-02T14:19:32+02:00
Reserve DLA-3858-1 for ruby2.7
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -190699,7 +190699,6 @@ CVE-2022-28739 (There is a buffer over-read in Ruby
before 2.6.10, 2.7.x before
{DLA-3450-1}
- ruby3.0 3.0.4-1 (bug #1009956)
- ruby2.7 <removed> (bug #1009957)
- [bullseye] - ruby2.7 <postponed> (Minor issue, fix with next Ruby
security release)
- ruby2.5 <removed>
- ruby2.3 <removed>
[stretch] - ruby2.3 <postponed> (Minor issue; fix in next LTS release)
@@ -249334,7 +249333,6 @@ CVE-2021-33621 (The cgi gem before 0.1.0.2, 0.2.x
before 0.2.2, and 0.3.x before
- ruby3.1 3.1.2-4 (bug #1024799)
- ruby3.0 <removed> (bug #1024800)
- ruby2.7 <removed>
- [bullseye] - ruby2.7 <no-dsa> (Minor issue)
- ruby2.5 <removed>
NOTE:
https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
NOTE: Fixed by:
https://github.com/ruby/cgi/commit/64c5045c0a6b84fdb938a8465a0890e5f7162708
(v0.3.4)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[02 Sep 2024] DLA-3858-1 ruby2.7 - security update
+ {CVE-2021-33621 CVE-2022-28739 CVE-2023-28755 CVE-2023-28756
CVE-2023-36617 CVE-2024-27280 CVE-2024-27281 CVE-2024-27282}
+ [bullseye] - ruby2.7 2.7.4-1+deb11u2
[26 Aug 2024] DLA-3857-1 libtommath - security update
{CVE-2023-36328}
[bullseye] - libtommath 1.2.0-6+deb11u1
=====================================
data/dla-needed.txt
=====================================
@@ -268,12 +268,6 @@ ruby-tzinfo (Adrian Bunk)
NOTE: 20220723: Added by stable Security Team (jmm)
NOTE: 20240815: Follow fixes from DLA-3077-1 (CVE-2022-31163)
(Beuc/front-desk)
--
-ruby2.7 (Sylvain Beucler)
- NOTE: 20230508: Added by stable Security Team (jmm)
- NOTE: 20240716: Samuel Henrique (samueloph) is working on a update
- NOTE: 20240801: LTS contribution WIP at
https://salsa.debian.org/lts-team/packages/ruby/-/commits/debian/bullseye/
(Beuc)
- NOTE: 20240819: Waiting for bullseye-lts to accept uploads (Beuc)
---
setuptools (dleidert)
NOTE: 20240730: Added by oldstable Security Team (jmm)
NOTE: 20240815: A bookworm DSA is planned (Beuc/front-desk)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26ad789fdea89d7f261cdbe36fa8156d8b3fbd04
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26ad789fdea89d7f261cdbe36fa8156d8b3fbd04
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
