Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ea51398c by Salvatore Bonaccorso at 2025-07-04T23:02:31+02:00
Add CVE-2025-49601/mbedtls
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -91,7 +91,10 @@ CVE-2025-49809 (mtr through 0.95, in certain privileged
contexts, mishandles exe
- mtr <unfixed>
NOTE: Fixed by:
https://github.com/traviscross/mtr/commit/5226f105f087c29d3cfad9f28000e7536af91ac6
CVE-2025-49601 (In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key
does not ...)
- TODO: check
+ - mbedtls <unfixed>
+ [bookworm] - mbedtls <not-affected> (Vulnerable code not present)
+ [bullseye] - mbedtls <not-affected> (Vulnerable code not present)
+ NOTE:
https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-4.md
CVE-2025-49600 (In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept
invalid s ...)
- mbedtls <unfixed>
[bookworm] - mbedtls <not-affected> (Vulnerable code not present)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea51398ca789cc0591bddcd55a5614eb06d75981
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea51398ca789cc0591bddcd55a5614eb06d75981
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
