<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<h3>
Markus Koschany pushed to branch master
at <a href="https://salsa.debian.org/security-tracker-team/security-tracker">Debian Security Tracker / security-tracker</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3df8707bfed5f3d3a9009d31d7655ddfa55c99c2">3df8707b</a></strong>
<div>
<span>by Markus Koschany</span>
<i>at 2022-05-06T16:00:08+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Remove twig from dla-/dsa-needed.txt.
The arrow function was first introduced in Twig 2.12. Stretch and
Buster are not affected.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a832eed5760816c703cea8627e6feeb38a1656c7">a832eed5</a></strong>
<div>
<span>by Markus Koschany</span>
<i>at 2022-05-06T16:04:30+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">CVE-2022-23614,twig: Stretch and Buster are not affected
The vulnerable code was introduced later.
</pre>
</li>
</ul>
<h4>3 changed files:</h4>
<ul>
<li class="file-stats">
<a href="#4716ef5aa8f2742228ba3b3633215c8b808565e3">
data/CVE/list
</a>
</li>
<li class="file-stats">
<a href="#451c03275399f1318aed4e8b2d621183019720c6">
data/dla-needed.txt
</a>
</li>
<li class="file-stats">
<a href="#922f24d99bcbb71f467600d4a765aa2ac5ee31f5">
data/dsa-needed.txt
</a>
</li>
</ul>
<h4>Changes:</h4>
<li id="4716ef5aa8f2742228ba3b3633215c8b808565e3">
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9a8e2b9590820b623fe62835ec21d119a7b9921e...a832eed5760816c703cea8627e6feeb38a1656c7#4716ef5aa8f2742228ba3b3633215c8b808565e3"><strong>data/CVE/list</strong></a>
<hr>
No preview for this file type
<br>
</li>
<li id="451c03275399f1318aed4e8b2d621183019720c6">
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9a8e2b9590820b623fe62835ec21d119a7b9921e...a832eed5760816c703cea8627e6feeb38a1656c7#451c03275399f1318aed4e8b2d621183019720c6"><strong>data/dla-needed.txt</strong></a>
<hr>
<table class="code white" style="font-family: monospace; font-size: 90%;" bgcolor="#fff" width="100%" cellpadding="0" cellspacing="0">
<tr class="line_holder match" style="line-height: 1.6;">
<td class="diff-line-num unfold js-unfold old_line" data-linenumber="179" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td>
<td class="diff-line-num unfold js-unfold new_line" data-linenumber="179" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td>
<td class="line_content match" style="padding-left: 0.5em; padding-right: 0.5em; color: rgba(0,0,0,0.3);" bgcolor="#fafafa">@@ -179,9 +179,6 @@ tiff (Utkarsh)</td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="179" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
179
</td>
<td class="new_line diff-line-num" data-linenumber="179" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
179
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC179" class="line" lang="plaintext"> NOTE: 20220419: new CVE reported; waiting to see if there are more. (utkarsh)</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="180" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
180
</td>
<td class="new_line diff-line-num" data-linenumber="180" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
180
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC180" class="line" lang="plaintext"> NOTE: 20220502: will collate the new CVEs and update the package. (utkarsh)</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="181" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
181
</td>
<td class="new_line diff-line-num" data-linenumber="181" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
181
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC181" class="line" lang="plaintext">--</span>
</pre></td>
</tr>
<tr class="line_holder old" style="line-height: 1.6;">
<td class="old_line diff-line-num old" data-linenumber="182" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
182
</td>
<td class="new_line diff-line-num old" data-linenumber="182" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">-<span id="LC182" class="line" lang="plaintext">twig (Markus Koschany)</span>
</pre></td>
</tr>
<tr class="line_holder old" style="line-height: 1.6;">
<td class="old_line diff-line-num old" data-linenumber="183" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
183
</td>
<td class="new_line diff-line-num old" data-linenumber="182" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">-<span id="LC183" class="line" lang="plaintext"> NOTE: 20220402: cf. DSA-5107-1; similar code in lib/Twig/Extension/Core.php (Beuc)</span>
</pre></td>
</tr>
<tr class="line_holder old" style="line-height: 1.6;">
<td class="old_line diff-line-num old" data-linenumber="184" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
184
</td>
<td class="new_line diff-line-num old" data-linenumber="182" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">-<span id="LC184" class="line" lang="plaintext">--</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="185" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
185
</td>
<td class="new_line diff-line-num" data-linenumber="182" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
182
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC182" class="line" lang="plaintext">unzip</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="186" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
186
</td>
<td class="new_line diff-line-num" data-linenumber="183" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
183
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC183" class="line" lang="plaintext"> NOTE: 20220319: no patches yet but reproducible (apo)</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="187" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
187
</td>
<td class="new_line diff-line-num" data-linenumber="184" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
184
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC184" class="line" lang="plaintext"> NOTE: 20220429: CVE-2022-0530: reported #1010355 with a proposed patch (enrico)</span>
</pre></td>
</tr>
</table>
<br>
</li>
<li id="922f24d99bcbb71f467600d4a765aa2ac5ee31f5">
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9a8e2b9590820b623fe62835ec21d119a7b9921e...a832eed5760816c703cea8627e6feeb38a1656c7#922f24d99bcbb71f467600d4a765aa2ac5ee31f5"><strong>data/dsa-needed.txt</strong></a>
<hr>
<table class="code white" style="font-family: monospace; font-size: 90%;" bgcolor="#fff" width="100%" cellpadding="0" cellspacing="0">
<tr class="line_holder match" style="line-height: 1.6;">
<td class="diff-line-num unfold js-unfold old_line" data-linenumber="54" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td>
<td class="diff-line-num unfold js-unfold new_line" data-linenumber="54" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td>
<td class="line_content match" style="padding-left: 0.5em; padding-right: 0.5em; color: rgba(0,0,0,0.3);" bgcolor="#fafafa">@@ -54,8 +54,6 @@ sox</td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="54" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
54
</td>
<td class="new_line diff-line-num" data-linenumber="54" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
54
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC54" class="line" lang="plaintext">trafficserver (jmm)</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="55" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
55
</td>
<td class="new_line diff-line-num" data-linenumber="55" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
55
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC55" class="line" lang="plaintext"> wait until status for CVE-2021-38161 is clarified (upstream patch got reverted)</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="56" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
56
</td>
<td class="new_line diff-line-num" data-linenumber="56" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
56
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC56" class="line" lang="plaintext">--</span>
</pre></td>
</tr>
<tr class="line_holder old" style="line-height: 1.6;">
<td class="old_line diff-line-num old" data-linenumber="57" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
57
</td>
<td class="new_line diff-line-num old" data-linenumber="57" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">-<span id="LC57" class="line" lang="plaintext">twig/oldstable</span>
</pre></td>
</tr>
<tr class="line_holder old" style="line-height: 1.6;">
<td class="old_line diff-line-num old" data-linenumber="58" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
58
</td>
<td class="new_line diff-line-num old" data-linenumber="57" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">-<span id="LC58" class="line" lang="plaintext">--</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="59" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
59
</td>
<td class="new_line diff-line-num" data-linenumber="57" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
57
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC57" class="line" lang="plaintext">unzip</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="60" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
60
</td>
<td class="new_line diff-line-num" data-linenumber="58" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
58
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC58" class="line" lang="plaintext"> no details public yet</span>
</pre></td>
</tr>
<tr class="line_holder" style="line-height: 1.6;">
<td class="old_line diff-line-num" data-linenumber="61" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
61
</td>
<td class="new_line diff-line-num" data-linenumber="59" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
59
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> <span id="LC59" class="line" lang="plaintext">--</span>
</pre></td>
</tr>
</table>
<br>
</li>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
<a href="https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9a8e2b9590820b623fe62835ec21d119a7b9921e...a832eed5760816c703cea8627e6feeb38a1656c7">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
</p>
</div>
</body>
</html>