From a7c7cb8f7e52ce9961dd40e9c18573e80a2a519d Mon Sep 17 00:00:00 2001 From: Anton Gladky Date: Tue, 27 Sep 2022 06:08:00 +0200 Subject: Reserve DLA-3122-1 for dovecot --- data/CVE/list | 2 -- data/DLA/list | 3 +++ data/dla-needed.txt | 5 ----- 3 files changed, 3 insertions(+), 7 deletions(-) diff --git a/data/CVE/list b/data/CVE/list index a1fc770db4..7f877ee432 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -29107,7 +29107,6 @@ CVE-2022-30551 (OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to CVE-2022-30550 (An issue was discovered in the auth component in Dovecot 2.2 and 2.3 b ...) - dovecot 1:2.3.19.1+dfsg1-2 (bug #1016351) [bullseye] - dovecot 1:2.3.13+dfsg1-2+deb11u1 - [buster] - dovecot (Minor issue) NOTE: https://www.openwall.com/lists/oss-security/2022/07/06/9 NOTE: https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904 NOTE: https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b @@ -92518,7 +92517,6 @@ CVE-2021-33516 (An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2. NOTE: https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118659b589afac (master) CVE-2021-33515 (The submission service in Dovecot before 2.3.15 allows STARTTLS comman ...) - dovecot 1:2.3.13+dfsg1-2 (bug #990566) - [buster] - dovecot (Minor issue, fix along with next update) [stretch] - dovecot (Vulnerable code (smtp_server_command queue) introduced later) NOTE: https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html NOTE: https://www.openwall.com/lists/oss-security/2021/06/28/2 diff --git a/data/DLA/list b/data/DLA/list index 634cd1852e..065daa41f1 100644 --- a/data/DLA/list +++ b/data/DLA/list @@ -1,3 +1,6 @@ +[27 Sep 2022] DLA-3122-1 dovecot - security update + {CVE-2021-33515 CVE-2022-30550} + [buster] - dovecot 1:2.3.4.1-5+deb10u7 [26 Sep 2022] DLA-3121-1 firefox-esr - security update {CVE-2022-40956 CVE-2022-40957 CVE-2022-40958 CVE-2022-40959 CVE-2022-40960 CVE-2022-40962} [buster] - firefox-esr 102.3.0esr-1~deb10u2 diff --git a/data/dla-needed.txt b/data/dla-needed.txt index d403f18823..53bf0b1715 100644 --- a/data/dla-needed.txt +++ b/data/dla-needed.txt @@ -30,11 +30,6 @@ curl NOTE: 20220904: VCS: https://salsa.debian.org/lts-team/packages/curl.git NOTE: 20220904: Special attention: high popcon!. -- -dovecot (Anton) - NOTE: 20220913: Programming language: C. - NOTE: 20220913: VCS: https://salsa.debian.org/lts-team/packages/dovecot.git - NOTE: 20220913: Harmonize with bullseye: 1 CVE fixed in Debian 11.5 + 2 other postponed CVEs (Beuc/front-desk) --- exiv2 NOTE: 20220819: Programming language: C++. NOTE: 20220819: https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3#diff-bd28aafd4c87975a3a236af74c2200db447587fa0bb4f43ba9beb98738c77b2aL292 does not directly apply, but a very quick glance suggests the earlier code may be equally vulnerable. (Chris Lamb) -- cgit v1.2.3