Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6e32da8c by Sylvain Beucler at 2024-03-14T12:34:47+01:00
Tidy golang* buster triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -17035,7 +17035,7 @@ CVE-2023-50658 (The jose2go component before 1.6.0 for
Go allows attackers to ca
- golang-github-dvsekhvalnov-jose2go <unfixed> (bug #1059507)
[bookworm] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
[bullseye] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
- [buster] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
+ [buster] - golang-github-dvsekhvalnov-jose2go <postponed> (Limited
support, minor issue, follow bullseye DSAs/point-releases)
NOTE:
https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317
(v1.6.0)
CVE-2023-50339 (Stored cross-site scripting vulnerability exists in the User
Managemen ...)
NOT-FOR-US: GROWI
@@ -18553,7 +18553,7 @@ CVE-2023-48795 (The SSH transport protocol with certain
OpenSSH extensions, foun
- golang-go.crypto 1:0.17.0-1 (bug #1059003)
[bookworm] - golang-go.crypto <no-dsa> (Minor issue)
[bullseye] - golang-go.crypto <no-dsa> (Minor issue)
- [buster] - golang-go.crypto <no-dsa> (Minor issue)
+ [buster] - golang-go.crypto <postponed> (Limited support, minor issue,
follow bullseye DSAs/point-releases)
- jsch <not-affected> (ChaCha20-Poly1305 support introduced in 0.1.61;
*-EtM support introduced in 0.1.58)
- libssh 0.10.6-1 (bug #1059004)
- libssh2 1.11.0-4 (bug #1059005)
@@ -56964,7 +56964,7 @@ CVE-2023-29408 (The TIFF decoder does not place a limit
on the size of compresse
- golang-golang-x-image 0.11.0-1 (bug #1043159)
[bookworm] - golang-golang-x-image <no-dsa> (Minor issue)
[bullseye] - golang-golang-x-image <no-dsa> (Minor issue)
- [buster] - golang-golang-x-image <no-dsa> (Limited support, minor
issue, DoS)
+ [buster] - golang-golang-x-image <postponed> (Limited support, minor
issue, DoS)
NOTE: https://go.dev/issue/61582
NOTE: https://go.dev/cl/514897
NOTE:
https://github.com/golang/image/commit/cb227cd2c919b27c6206fe0c1041a8bcc677949d
(v0.10.0)
@@ -67304,7 +67304,7 @@ CVE-2023-26125 (Versions of the package
github.com/gin-gonic/gin before 1.9.0 ar
- golang-github-gin-gonic-gin <unfixed> (bug #1035498)
[bookworm] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
[bullseye] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
- [buster] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
+ [buster] - golang-github-gin-gonic-gin <postponed> (Limited support,
minor issue, follow bullseye DSAs/point-releases)
NOTE: https://github.com/gin-gonic/gin/pull/3500
NOTE: https://github.com/gin-gonic/gin/pull/3503
NOTE:
https://github.com/gin-gonic/gin/commit/81ac7d55a09e34013225db0aeac6e70c1ae68928
(v1.9.0)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e32da8cc8402aa58089df0e41fad6ee94eed5d4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e32da8cc8402aa58089df0e41fad6ee94eed5d4
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
