[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Mark CVE-2017-1001001/pluxml as fixed via unstable upload

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
894fd08c by Salvatore Bonaccorso at 2018-03-22T16:43:28+01:00
Mark CVE-2017-1001001/pluxml as fixed via unstable upload

Upstream has not yet properly fixed it, but the Debian package with the
5.6-1 uploads adds a mitigation for CVE-2017-1001001 and sets explicitly
session.cookie_httponly to true.

Details: https://github.com/pluxml/PluXml/issues/253

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -26228,9 +26228,9 @@ CVE-2017-16352 (GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overf
 	NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset;node=7292230dd185
 	NOTE: https://blogs.securiteam.com/index.php/archives/3494
 CVE-2017-1001001 (PluXml version 5.6 is vulnerable to stored cross-site scripting ...)
-	- pluxml <unfixed> (bug #881796)
-	[jessie] - pluxml <no-dsa> (Minor issue)
+	- pluxml 5.6-1 (bug #881796)
 	[stretch] - pluxml <no-dsa> (Minor issue)
+	[jessie] - pluxml <no-dsa> (Minor issue)
 	NOTE: https://github.com/pluxml/PluXml/issues/253
 CVE-2017-1000244 (Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF ...)
 	NOT-FOR-US: Jenkins plugin



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/894fd08cec9990f82fb9983e0945e9479586def3

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/894fd08cec9990f82fb9983e0945e9479586def3
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180322/9c2d4135/attachment.html>