Tobias Frost pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e494cd25 by Tobias Frost at 2024-03-10T18:58:45+01:00
Reserve DLA-3757-1 for nss.
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -27496,7 +27496,6 @@ CVE-2023-5388
- nss 2:3.98-1 (bug #1056284)
[bookworm] - nss <no-dsa> (Minor issue)
[bullseye] - nss <no-dsa> (Minor issue)
- [buster] - nss <no-dsa> (Minor issue)
NOTE: https://people.redhat.com/~hkario/marvin/
NOTE: Vendor patch (Rocky Linux, not upstreamed):
https://git.rockylinux.org/staging/rpms/nss/-/commit/1f7f7523b61a2ada2f461548c4160fbbf979c5dd
NOTE: Fixed by:
https://hg.mozilla.org/projects/nss/rev/196716d8377ab427e326f20bff2d026e90ac69e2
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[10 Mar 2024] DLA-3757-1 nss - security update
+ {CVE-2023-5388 CVE-2024-0743}
+ [buster] - nss 2:3.42.1-1+deb10u8
[10 Mar 2024] DLA-3756-1 wordpress - security update
[buster] - wordpress 5.0.21+dfsg1-0+deb10u1
[09 Mar 2024] DLA-3755-1 tar - security update
=====================================
data/dla-needed.txt
=====================================
@@ -166,12 +166,8 @@ nova
--
nss (tobi)
NOTE: 20240121: Added by Front-Desk (apo)
- NOTE: 20240209: <tobi> There is currently no (public) patch for
CVE-2023-5388 - RedHat seems to have one in private… (tobi)
- NOTE: 20240209: Tried to backport patches for CVE-2023-6135, however it is
unclear which bits are required or if the
- NOTE: 20240209: fix would be to backport nss to utilize HACL*. The version
in buster does not have the NIST ciphers
- NOTE: 20240209: in the files touched by the upstream patch. TL;DR: I'm
unsure if the prepared patches are fixing the vulnerabilty.
- NOTE: 20240209: The backported patches are in the LTS repository,
CVE-2023-6135*.patch </tobi>
- NOTE: 20230227: Upstream suggests to wait until they have a patch for 3.90
(their LTS version) available and backport from there.
+ NOTE: 20240310: CVE-2023-6135: Upstream suggests to wait until they have a
patch for 3.90 (their LTS version) available and backport from there.
+ NOTE: 20230310: see also: Message-ID:
<zd5gymuvvidu5...@isildor2.loewenhoehle.ip>
--
nvidia-graphics-drivers
NOTE: 20240303: Added by Front-Desk (apo)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e494cd253be892f0ab8bd86e86074788f6b9cc01
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e494cd253be892f0ab8bd86e86074788f6b9cc01
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
