Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker
Commits: ec479a33 by Markus Koschany at 2023-04-18T22:40:56+02:00 CVE-2023-27585,asterisk: Buster is affected The vulnerable code is shipped in debian/pjproject_2.12.1~dfsg.orig.tar.bz2 and applied at build time. In the past the pjproject library has been packaged separately. Debian's maintainer chose to embed it later. - - - - - 1b52d3ba by Markus Koschany at 2023-04-18T22:40:56+02:00 LTS: add asterisk to dla-needed.txt - - - - - 480c118b by Markus Koschany at 2023-04-18T22:40:56+02:00 Claim asterisk in dla-needed.txt - - - - - 2 changed files: - data/CVE/list - data/dla-needed.txt Changes: ===================================== data/CVE/list ===================================== @@ -9774,7 +9774,6 @@ CVE-2023-27586 (CairoSVG is an SVG converter based on Cairo, a 2D graphics libra NOTE: Introduced in https://github.com/Kozea/CairoSVG/commit/1ee0889f4015ebaddcf9976d43222e673155797c (0.3) CVE-2023-27585 (PJSIP is a free and open source multimedia communication library writt ...) - asterisk <unfixed> - [buster] - asterisk <not-affected> (Vulnerable code not present) - pjproject <removed> - ring <unfixed> NOTE: https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr ===================================== data/dla-needed.txt ===================================== @@ -26,6 +26,11 @@ apache2 NOTE: 20230312: Special attention: Double check an update! Package is used by many customers and users!. NOTE: 20230326: VCS: https://salsa.debian.org/apache-team/apache2. Yadd is ok for using apache2 salsa tree -- +asterisk (Markus Koschany) + NOTE: 20230418: Programming language: C. + NOTE: 20230418: VCS: https://salsa.debian.org/lts-team/packages/asterisk.git + NOTE: 20230418: Special attention: pjproject library is included in debian directory!. +-- cairosvg (dleidert) NOTE: 20230323: Programming language: Python. NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport the --unsafe switch, introduced in 1.0.21, might work (dleidert) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits