<html><head></head><body>Hi,<br><br>Of course a point release is enough here<br><br><br>Cheers,<br>Xavier<br><br><div class="gmail_quote">Le 26 septembre 2019 08:04:35 GMT+02:00, Salvatore Bonaccorso <carnil@debian.org> a écrit :<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi Xavier,<br><br>On Thu, Sep 26, 2019 at 07:31:21AM +0200, Xavier wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Le 26/09/2019 à 07:12, Salvatore Bonaccorso a écrit :<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Source: node-set-value<br>Version: 0.4.0-1<br>Severity: important<br>Tags: security upstream<br>Control: found -1 3.0.0-1<br><br>Hi,<br><br>The following vulnerability was published for node-set-value.<br><br>CVE-2019-10747[0]:<br>| set-value is vulnerable to Prototype Pollution in versions lower than<br>| 3.0.1. The function mixin-deep could be tricked into adding or<br>| modifying properties of Object.prototype using any of the constructor,<br>| prototype and _proto_ payloads.<br><br><br>If you fix the vulnerability please also make sure to include the<br>CVE (Common Vulnerabilities & Exposures) id in your changelog entry.<br><br>For further information see:<br><br>[0] <a href="https://security-tracker.debian.org/tracker/CVE-2019-10747">https://security-tracker.debian.org/tracker/CVE-2019-10747</a><br> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747</a><br>[1] <a href="https://snyk.io/vuln/SNYK-JS-SETVALUE-450213">https://snyk.io/vuln/SNYK-JS-SETVALUE-450213</a><br></blockquote><br>Hi,<br><br>here is a patch for Buster<br></blockquote><br>Thanks, you are fast :). I think like other similar cases for node-*<br>modules we can go the buster-pu route here as well.<br><br>Unless you object, I will mark it as no-dsa (Can be fixed via point<br>release).<br><br>Regards,<br>Salvatore<br></pre></blockquote></div><br>-- <br>Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.</body></html>