summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnton Gladky <gladk@debian.org>2022-09-27 06:08:00 +0200
committerAnton Gladky <gladk@debian.org>2022-09-27 06:08:00 +0200
commita7c7cb8f7e52ce9961dd40e9c18573e80a2a519d (patch)
tree90506e041ce9935365611ed86727c21948bdfea0
parentfaf969cd293fcd24ba8e8f2105981d0f964a230f (diff)
Reserve DLA-3122-1 for dovecot
-rw-r--r--data/CVE/list2
-rw-r--r--data/DLA/list3
-rw-r--r--data/dla-needed.txt5
3 files changed, 3 insertions, 7 deletions
diff --git a/data/CVE/list b/data/CVE/list
index a1fc770db4..7f877ee432 100644
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -29107,7 +29107,6 @@ CVE-2022-30551 (OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to
CVE-2022-30550 (An issue was discovered in the auth component in Dovecot 2.2 and 2.3 b ...)
- dovecot 1:2.3.19.1+dfsg1-2 (bug #1016351)
[bullseye] - dovecot 1:2.3.13+dfsg1-2+deb11u1
- [buster] - dovecot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/07/06/9
NOTE: https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904
NOTE: https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b
@@ -92518,7 +92517,6 @@ CVE-2021-33516 (An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.
NOTE: https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118659b589afac (master)
CVE-2021-33515 (The submission service in Dovecot before 2.3.15 allows STARTTLS comman ...)
- dovecot 1:2.3.13+dfsg1-2 (bug #990566)
- [buster] - dovecot <postponed> (Minor issue, fix along with next update)
[stretch] - dovecot <not-affected> (Vulnerable code (smtp_server_command queue) introduced later)
NOTE: https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html
NOTE: https://www.openwall.com/lists/oss-security/2021/06/28/2
diff --git a/data/DLA/list b/data/DLA/list
index 634cd1852e..065daa41f1 100644
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[27 Sep 2022] DLA-3122-1 dovecot - security update
+ {CVE-2021-33515 CVE-2022-30550}
+ [buster] - dovecot 1:2.3.4.1-5+deb10u7
[26 Sep 2022] DLA-3121-1 firefox-esr - security update
{CVE-2022-40956 CVE-2022-40957 CVE-2022-40958 CVE-2022-40959 CVE-2022-40960 CVE-2022-40962}
[buster] - firefox-esr 102.3.0esr-1~deb10u2
diff --git a/data/dla-needed.txt b/data/dla-needed.txt
index d403f18823..53bf0b1715 100644
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -30,11 +30,6 @@ curl
NOTE: 20220904: VCS: https://salsa.debian.org/lts-team/packages/curl.git
NOTE: 20220904: Special attention: high popcon!.
--
-dovecot (Anton)
- NOTE: 20220913: Programming language: C.
- NOTE: 20220913: VCS: https://salsa.debian.org/lts-team/packages/dovecot.git
- NOTE: 20220913: Harmonize with bullseye: 1 CVE fixed in Debian 11.5 + 2 other postponed CVEs (Beuc/front-desk)
---
exiv2
NOTE: 20220819: Programming language: C++.
NOTE: 20220819: https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3#diff-bd28aafd4c87975a3a236af74c2200db447587fa0bb4f43ba9beb98738c77b2aL292 does not directly apply, but a very quick glance suggests the earlier code may be equally vulnerable. (Chris Lamb)

© 2014-2024 Faster IT GmbH | imprint | privacy policy