From c931d850fb446bda7dc01c4dff4ae86b6a47d275 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Moritz=20M=C3=BChlenhoff?= Date: Tue, 4 Jan 2022 17:16:13 +0100 Subject: buster/bullseye triage --- data/CVE/2021.list | 16 +++++++++++++++- data/CVE/2022.list | 2 ++ data/dsa-needed.txt | 2 ++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/data/CVE/2021.list b/data/CVE/2021.list index c51313ab5e..db502d438d 100644 --- a/data/CVE/2021.list +++ b/data/CVE/2021.list @@ -537,9 +537,13 @@ CVE-2021-4189 [ftplib should not use the host from the PASV response] RESERVED - python3.10 (Fixed before initial upload to Debian unstable) - python3.9 3.9.7-1 + [bullseye] - python3.9 (Minor issue) - python3.7 + [buster] - python3.7 (Minor issue) - python3.5 - python2.7 + [bullseye] - python2.7 (Python 2.7 in Bullseye not covered by security support) + [buster] - python2.7 (Minor issue) NOTE: https://bugs.python.org/issue43285 NOTE: https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e (master) NOTE: https://github.com/python/cpython/commit/7dcb4baa4f0fde3aef5122a8e9f6a41853ec9335 (v3.9.3) @@ -2737,6 +2741,8 @@ CVE-2021-45041 (SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated NOT-FOR-US: SuiteCRM CVE-2021-4110 (mruby is vulnerable to NULL Pointer Dereference ...) - mruby (bug #1001768) + [bullseye] - mruby (Minor issue) + [buster] - mruby (Minor issue) [stretch] - mruby (revisit when/if fix is complete) NOTE: https://huntr.dev/bounties/4ce5dc47-2512-4c87-8609-453adc8cad20 NOTE: https://github.com/mruby/mruby/commit/f5e10c5a79a17939af763b1dcf5232ce47e24a34 @@ -3193,6 +3199,8 @@ CVE-2021-44848 (In Cibele Thinfinity VirtualUI before 3.0, /changePassword retur NOT-FOR-US: Cibele Thinfinity VirtualUI CVE-2021-44847 (A stack-based buffer overflow in handle_request function in DHT.c in t ...) - libtoxcore 0.2.13-1 (bug #1001711) + [bullseye] - libtoxcore (Minor issue) + [buster] - libtoxcore (Minor issue) NOTE: https://github.com/TokTok/c-toxcore/pull/1718 NOTE: https://blog.tox.chat/2021/12/stack-based-buffer-overflow-vulnerability-in-udp-packet-handling-in-toxcore-cve-2021-44847/ NOTE: Introduced by: https://github.com/TokTok/c-toxcore/commit/71260e38e8d12547b0e55916daf6cadd72f52e19 (v0.1.9) @@ -11452,11 +11460,13 @@ CVE-2021-41497 (Null pointer reference in CMS_Conservative_increment_obj in RaRe NOT-FOR-US: RaRe-Technologies bounter CVE-2021-41496 (Buffer overflow in the array_from_pyobj function of fortranobject.c in ...) - numpy + [bullseye] - numpy (Minor issue) NOTE: https://github.com/numpy/numpy/issues/19000 NOTE: https://github.com/numpy/numpy/pull/20630 NOTE: https://github.com/numpy/numpy/commit/271010f1037150e95017f803f4214b8861e528f2 CVE-2021-41495 (Null Pointer Dereference vulnerability exists in numpy.sort in NumPy & ...) - numpy + [bullseye] - numpy (Minor issue) NOTE: https://github.com/numpy/numpy/issues/19038 TODO: check for classification/severity CVE-2021-41494 @@ -21729,6 +21739,8 @@ CVE-2021-37233 RESERVED CVE-2021-37232 (A stack overflow vulnerability occurs in Atomicparsley 20210124.204813 ...) - atomicparsley 20210715.151551.e7ad03a-1 (bug #993366) + [bullseye] - atomicparsley (Minor issue) + [buster] - atomicparsley (Minor issue) [stretch] - atomicparsley (Minor issue) - gtkpod (bug #993376) [bullseye] - gtkpod (Minor issue) @@ -21738,6 +21750,8 @@ CVE-2021-37232 (A stack overflow vulnerability occurs in Atomicparsley 20210124. NOTE: https://github.com/wez/atomicparsley/issues/32 CVE-2021-37231 (A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499 ...) - atomicparsley 20210715.151551.e7ad03a-1 (bug #993372) + [bullseye] - atomicparsley (Minor issue) + [buster] - atomicparsley (Minor issue) [stretch] - atomicparsley (Minor issue) - gtkpod (bug #993375) [bullseye] - gtkpod (Minor issue) @@ -28823,9 +28837,9 @@ CVE-2021-34142 RESERVED CVE-2021-34141 (Incomplete string comparison in the numpy.core component in NumPy1.9.x ...) - numpy + [bullseye] - numpy (Minor issue) NOTE: https://github.com/numpy/numpy/issues/18993 NOTE: https://github.com/numpy/numpy/commit/eeef9d4646103c3b1afd3085f1393f2b3f9575b2 (v1.23.0.dev0) - TODO: check CVE-2021-34140 RESERVED CVE-2021-34139 diff --git a/data/CVE/2022.list b/data/CVE/2022.list index 6dca4d7351..d214ebf1b0 100644 --- a/data/CVE/2022.list +++ b/data/CVE/2022.list @@ -482,6 +482,8 @@ CVE-2022-0081 RESERVED CVE-2022-0080 (mruby is vulnerable to Heap-based Buffer Overflow ...) - mruby + [bullseye] - mruby (Minor issue) + [buster] - mruby (Minor issue) NOTE: https://huntr.dev/bounties/59a70392-4864-4ce3-8e35-6ac2111d1e2e/ NOTE: https://github.com/mruby/mruby/commit/28ccc664e5dcd3f9d55173e9afde77c4705a9ab6 CVE-2022-0079 (showdoc is vulnerable to Generation of Error Message Containing Sensit ...) diff --git a/data/dsa-needed.txt b/data/dsa-needed.txt index 751a91ba15..5df89ceac1 100644 --- a/data/dsa-needed.txt +++ b/data/dsa-needed.txt @@ -33,6 +33,8 @@ linux (carnil) Wait until more issues have piled up, though try to regulary rebase for point releases to more recent v4.19.y versions. -- +lxml +-- ndpi/oldstable -- nodejs (jmm) -- cgit v1.2.3