[Git][security-tracker-team/security-tracker][master] axis/CVE-2019-0227: wait for info on SSRF fix

[Sylvain Beucler]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4e8dda97 by Sylvain Beucler at 2019-04-13T09:11:50Z
axis/CVE-2019-0227: wait for info on SSRF fix

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -29810,7 +29810,8 @@ CVE-2019-0227 [Hard coded domain name in example web service named StockQuoteSer
 	- axis <unfixed> (unimportant)
 	NOTE: https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
 	NOTE: StockQuoteService.jws not present in Debian binary packages
-	NOTE: SSRF mitigation in XMLUtils trivial but no patch available (wrong link in above report)
+	NOTE: disclosure mentions "03/12/2019 - Apache applied SSRF patch" but no patch available, requested more info:
+	NOTE: https://github.com/RhinoSecurityLabs/CVEs/issues/1
 CVE-2019-0226
 	RESERVED
 CVE-2019-0225 (A specially crafted url could be used to access files under the ROOT d ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/4e8dda97d59a65cb8aee2d5fcd0bed2bb0571fd6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/4e8dda97d59a65cb8aee2d5fcd0bed2bb0571fd6
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190413/1523fca7/attachment.html>