Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0f3180c9 by Sylvain Beucler at 2024-05-04T18:05:59+02:00
node-ejs: follow stable triage, buster postponed
- - - - -
b1dd32d8 by Sylvain Beucler at 2024-05-04T18:10:48+02:00
CVE-2024-3572/python-scrapy: buster postponed
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3543,6 +3543,7 @@ CVE-2024-33883 (The ejs (aka Embedded JavaScript
templates) package before 3.1.1
- node-ejs 3.1.10+~3.1.5-1
[bookworm] - node-ejs <no-dsa> (Minor issue)
[bullseye] - node-ejs <no-dsa> (Minor issue)
+ [buster] - node-ejs <postponed> (Minor issue, follow bullseye)
NOTE:
https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5
(v3.1.10)
CVE-2024-33851 (phpecc, as used in paragonie/phpecc before 2.0.1, has a
branch-based t ...)
NOT-FOR-US: phpecc
@@ -7036,6 +7037,7 @@ CVE-2024-3572 (The scrapy/scrapy project is vulnerable to
XML External Entity (X
- python-scrapy 2.11.1-1
[bookworm] - python-scrapy <no-dsa> (Minor issue)
[bullseye] - python-scrapy <no-dsa> (Minor issue)
+ [buster] - python-scrapy <postponed> (Minor issue, DoS)
NOTE: https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
NOTE:
https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f
(2.11.1)
NOTE: The CVE and bounty descriptions discuss general XML issues (not
specifically XXE), but
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5c3f6593ac7705285bafd1e310639110f8b285a4...b1dd32d80f246b98c16b38ee19ae996c40eed42e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5c3f6593ac7705285bafd1e310639110f8b285a4...b1dd32d80f246b98c16b38ee19ae996c40eed42e
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
