[Git][security-tracker-team/security-tracker][master] three keepalived issues unimportant

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1035520 by Moritz Muehlenhoff at 2018-11-11T12:42:31Z
three keepalived issues unimportant
lighttpd, mini-httpd no-dsa

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -280,23 +280,25 @@ CVE-2017-18351
 	RESERVED
 CVE-2018-19052 (An issue was discovered in mod_alias_physical_handler in mod_alias.c in ...)
 	- lighttpd <unfixed>
+	[stretch] - lighttpd <no-dsa> (Minor issue)
 	NOTE: https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1
 CVE-2018-19048
 	RESERVED
 CVE-2018-19047 (** DISPUTED ** mPDF through 7.1.6, if deployed as a web application ...)
 	NOT-FOR-US: mPDF
 CVE-2018-19046 (keepalived 2.0.8 didn't check for existing plain files when writing ...)
-	- keepalived <unfixed>
+	- keepalived <unfixed> (unimportant)
 	NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
 	NOTE: https://github.com/acassen/keepalived/issues/1048
+	NOTE: Neutralised by kernel hardening
 CVE-2018-19045 (keepalived 2.0.8 used mode 0666 when creating new temporary files upon ...)
-	- keepalived <unfixed>
+	- keepalived <unfixed> (unimportant)
 	NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
 	NOTE: https://github.com/acassen/keepalived/commit/5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6
 	NOTE: https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067
-	NOTE: ttps://github.com/acassen/keepalived/issues/1048
+	NOTE: https://github.com/acassen/keepalived/issues/1048
 CVE-2018-19044 (keepalived 2.0.8 didn't check for pathnames with symlinks when writing ...)
-	- keepalived <unfixed>
+	- keepalived <unfixed> (unimportant)
 	NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
 	NOTE: https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306
 	NOTE: https://github.com/acassen/keepalived/issues/1048
@@ -878,6 +880,7 @@ CVE-2018-18779
 	RESERVED
 CVE-2018-18778 (ACME mini_httpd before 1.30 lets remote users read arbitrary files. ...)
 	- mini-httpd <unfixed> (bug #913095)
+	[stretch] - mini-httpd <no-dsa> (Minor issue)
 CVE-2018-18777 (Directory traversal vulnerability in Microstrategy Web, version 7, in ...)
 	NOT-FOR-US: Microstrategy Web
 CVE-2018-18776 (Microstrategy Web, version 7, does not sufficiently encode ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f10355208a0b294478531f1d2a2ef7a41cf06f28

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f10355208a0b294478531f1d2a2ef7a41cf06f28
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181111/dfe4ca57/attachment.html>