[Git][security-tracker-team/security-tracker][master] Add CVE-2018-1000858/gnupg issue with WKD

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d498c50c by Salvatore Bonaccorso at 2018-12-23T08:25:03Z
Add CVE-2018-1000858/gnupg issue with WKD

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -218,7 +218,14 @@ CVE-2018-1000860 (phpipam version 1.3.2 and earlier contains a Cross Site Script
 	- phpipam <itp> (bug #731713)
 	NOTE: https://github.com/phpipam/phpipam/issues/2338
 CVE-2018-1000858 (GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery ...)
-	TODO: check
+	- gnupg2 2.2.12-1
+	- gnupg1 <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
+	- gnupg <not-affected> (Vulnerable code introduced in 2.x in 2.1.12)
+	NOTE: WKD (Web Key Directory) feature introduced in 2.1.12
+	NOTE: https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html
+	NOTE: https://sektioneins.de/en/blog/18-11-23-gnupg-wkd.html
+	NOTE: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=fa1b1eaa4241ff3f0634c8bdf8591cbc7c464144 (master)
+	NOTE: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=4a4bb874f63741026bd26264c43bb32b1099f060 (2.2.12)
 CVE-2018-1000857 (log-user-session version 0.7 and earlier contains a Directory ...)
 	NOT-FOR-US: log-user-session
 CVE-2018-1000856 (DomainMOD version 4.09.03 and above. Also verified in the latest ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/d498c50cacbebd8b723d239a8798fd568412565f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/d498c50cacbebd8b723d239a8798fd568412565f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181223/bbc00b11/attachment.html>