Adrian Bunk pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ab87cbe8 by Adrian Bunk at 2025-08-23T02:29:01+03:00
CVE-2025-53689/jackrabbit does not affect the binary package
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -11537,11 +11537,12 @@ CVE-2025-7519 (A flaw was found in polkit. When
processing an XML policy with 32
NOTE: Fixed by:
https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245
NOTE: Negligible security impact
CVE-2025-53689 (Blind XXE Vulnerabilities in jackrabbit-spi-commons and
jackrabbit-cor ...)
- - jackrabbit 2.20.11-1.1 (bug #1109335)
+ - jackrabbit <not-affected> (Vulnerable code code not shipped in the
binary package)
NOTE: https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24
NOTE: https://issues.apache.org/jira/browse/JCR-5165
NOTE: https://github.com/apache/jackrabbit/pull/263
NOTE:
https://github.com/apache/jackrabbit/commit/1d6cb3d0fcc8d51980b90ddcf94122d3e4add83e
(jackrabbit-2.20.17)
+ NOTE: trixie was fixed in https://bugs.debian.org/1109335 but the
vulnerable classes are not in the binary package.
CVE-2025-53639 (MeterSphere is an open source continuous testing platform.
Prior to ve ...)
NOT-FOR-US: MeterSphere
CVE-2025-53623 (The Job Iteration API is an an extension for ActiveJob that
make jobs ...)
=====================================
data/dla-needed.txt
=====================================
@@ -189,10 +189,6 @@ intel-microcode
iperf3 (bunk)
NOTE: 20250805: Added by Front-Desk (rouca)
--
-jackrabbit (bunk)
- NOTE: 20250805: Added by Front-Desk (rouca)
- NOTE: 20250805: Asked for confirmation in #1109335 that the Debian package
is not affected. (bunk)
---
jackson-core
NOTE: 20250707: Added by Front-Desk (apo)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab87cbe86ee55e4dba0184e96fa60da89d11f68b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab87cbe86ee55e4dba0184e96fa60da89d11f68b
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
