Adrian Bunk pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d2027093 by Adrian Bunk at 2019-11-30T20:19:46Z
CVE-2017-7525 and CVE-2017-15095 are also in libjackson-json-java
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -119757,6 +119757,7 @@ CVE-2017-15096 (A flaw was found in GlusterFS in
versions prior to 3.10. A null
CVE-2017-15095 (A deserialization flaw was discovered in the jackson-databind
in versi ...)
{DSA-4037-1}
- jackson-databind 2.9.1-1
+ - libjackson-json-java <unfixed>
NOTE: The Debian upload for stretch (2.8.6-1+deb9u1) and jessie
(2.4.2-2+deb8u1)
NOTE: misses the further sets of blacklists, in particular as well
NOTE: https://github.com/FasterXML/jackson-databind/commit/3bfbb835
@@ -119771,6 +119772,8 @@ CVE-2017-15095 (A deserialization flaw was discovered
in the jackson-databind in
NOTE: NO_DESER_CLASS_NAMES as of:
NOTE:
https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43
NOTE: Details: http://www.openwall.com/lists/oss-security/2017/11/02/3
+ NOTE: For libjackson-json-java:
+ NOTE:
https://github.com/FasterXML/jackson-1/commit/9ac68db819bce7b9546bc4bf1c44f82ca910fa31
CVE-2017-15094 (An issue has been found in the DNSSEC parsing code of PowerDNS
Recurso ...)
- pdns-recursor 4.0.7-1
[stretch] - pdns-recursor 4.0.4-1+deb9u2
@@ -143019,10 +143022,13 @@ CVE-2017-7526 (libgcrypt before version 1.7.8 is
vulnerable to a cache side-chan
CVE-2017-7525 (A deserialization flaw was discovered in the jackson-databind,
version ...)
{DSA-4004-1}
- jackson-databind 2.9.1-1 (bug #870848)
+ - libjackson-json-java <unfixed>
NOTE: https://github.com/FasterXML/jackson-databind/issues/1599
CVE-2017-7524 (tpm2-tools versions before 1.1.1 are vulnerable to a password
leak due ...)
- tpm2-tools 2.1.0-1 (bug #866257)
NOTE:
https://github.com/01org/tpm2.0-tools/commit/c5d72beaab1cbbbe68271f4bc4b6670d69985157
+ NOTE: For libjackson-json-java:
+ NOTE:
https://github.com/FasterXML/jackson-1/commit/9ac68db819bce7b9546bc4bf1c44f82ca910fa31
CVE-2017-7523 (Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable
to buff ...)
NOT-FOR-US: Cygwin
CVE-2017-7522 (OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable
to deni ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d2027093b7f8a31ea376193b3d47a7a4707c0f86
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d2027093b7f8a31ea376193b3d47a7a4707c0f86
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
