Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2053c6ff by Sylvain Beucler at 2025-05-20T16:58:57+02:00
CVE-2024-58134/mojolicious: drop reference pull#2200 which was closed/ignored,
and pull#1791 with is an old confusing work-around unrelated to an actual fix
- - - - -
0d3b3874 by Sylvain Beucler at 2025-05-20T16:58:59+02:00
CVE-2024-58135/libmojolicious-perl: upstream dropped pull#2200, use
cryptx-based fix, triage as postponed pending further investigation
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5315,24 +5315,21 @@ CVE-2025-37799 (In the Linux kernel, the following
vulnerability has been resolv
CVE-2024-58135 (Mojolicious versions from 7.28 through 9.40 for Perl may
generate weak ...)
- libmojolicious-perl <unfixed> (bug #1104633)
[bookworm] - libmojolicious-perl <no-dsa> (Minor issue)
- [bullseye] - libmojolicious-perl <ignored> (Minor issue, upstream's fix
requires newer libcryptx-perl)
+ [bullseye] - libmojolicious-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/29241187/
- NOTE: https://github.com/mojolicious/mojo/pull/2200
+ NOTE:
https://github.com/mojolicious/mojo/commit/c82071556c569a251152892c8cc2fd0ad5a4be54
(v9.39)
NOTE: The problem does not occur if the user has configured a
cryptographically
NOTE: secure HMAC session secret, and upstream expects users to already
be doing
- NOTE: that for production deployments. In addition, upstream has
installed commit
- NOTE: c82071556c569a251152892c8cc2fd0ad5a4be54 such that recent
Mojolicious
- NOTE: automatically generates a secure session secret.
- NOTE: However, that commit requires libcryptx-perl >=0.080.
+ NOTE: that for production deployments. The fix automatically generates
a secure
+ NOTE: session secret. This requires libcryptx-perl, checking >=0.080
though
+ NOTE: it might work with earlier versions.
CVE-2024-58134 (Mojolicious versions from 0.999922 through 9.40 for Perl uses
a hard c ...)
- libmojolicious-perl <unfixed> (bug #1104648)
[bookworm] - libmojolicious-perl <no-dsa> (Minor issue)
[bullseye] - libmojolicious-perl <postponed> (Minor issue, upstream
expects production deployments to reconfigure default session secret)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/29247502/
- NOTE: https://github.com/mojolicious/mojo/pull/1791
- NOTE: https://github.com/mojolicious/mojo/pull/2200
- NOTE: The CVE covers the default static/guessable, and this behaviour
is unchanged by the
- NOTE: optional CryptX dependency.
+ NOTE: The CVE covers the default static/guessable secret, and this
behaviour is
+ NOTE: unchanged by the new CryptX dependency in v9.39.
CVE-2025-4222 (The Database Toolset plugin for WordPress is vulnerable to
Sensitive I ...)
NOT-FOR-US: WordPress plugin
CVE-2025-4218 (A vulnerability was found in handrew browserpilot up to 0.2.51.
It has ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/caade1d88c649eae36f6a4e4ccd7b7867da7d1fd...0d3b3874deee2f14eb0545f39ebbd5d6d419e722
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/caade1d88c649eae36f6a4e4ccd7b7867da7d1fd...0d3b3874deee2f14eb0545f39ebbd5d6d419e722
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
