Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: bccece48 by Salvatore Bonaccorso at 2018-01-29T06:36:38+01:00 Add new squid issues (CVE-2018-1000024, CVE-2018-1000027) - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== --- a/data/CVE/list +++ b/data/CVE/list @@ -2670,6 +2670,22 @@ CVE-2018-1000028 [nfsd: auth: Fix gid sorting when rootsquash enabled] NOTE: Fixed by: https://git.kernel.org/linus/1995266727fa8143897e89b55f5d3c79aa828420 NOTE: Introducing commit backported to 4.14.8 and 4.9.76. But Debian stretch NOTE: did never contain the vulnerable code alone without the fix. +CVE-2018-1000027 [SQUID-2018:2 Denial of Service issue in HTTP Message processing] + [experimental] - squid 4.0.23-1~exp8 + - squid <removed> + - squid3 <unfixed> + NOTE: src:squid as source package reintroduced for 4.x in experimental + NOTE: Squid 3.5: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patch + NOTE: Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patch + NOTE: http://www.squid-cache.org/Advisories/SQUID-2018_2.txt +CVE-2018-1000024 [SQUID-2018:1 Denial of Service issue in ESI Response processing] + [experimental] - squid 4.0.23-1~exp8 + - squid <removed> + - squid3 <unfixed> + NOTE: src:squid as source package reintroduced for 4.x in experimental + NOTE: Squid 3.5: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_1.patch + NOTE: Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_1.patch + NOTE: http://www.squid-cache.org/Advisories/SQUID-2018_1.txt CVE-2018-1000022 [Password protect the JSONRPC interface] - electrum 3.0.5-1 (bug #886683) [stretch] - electrum <ignored> (Unable to connect to current Etherum servers and thus not exploitable, scheduled for removal at #887412) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bccece48bad201170dbfe2e91e95876420a2f513 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bccece48bad201170dbfe2e91e95876420a2f513 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits