[Git][security-tracker-team/security-tracker][master] 2 commits: Process more NFUs

Salvatore Bonaccorso carnil at debian.org
Wed Feb 5 20:55:24 GMT 2020 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
240bfdbf by Salvatore Bonaccorso at 2020-02-05T21:53:36+01:00
Process more NFUs

- - - - -
55346ee7 by Salvatore Bonaccorso at 2020-02-05T21:54:49+01:00
Mark intel-microcode CVEs as postponed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1082,7 +1082,7 @@ CVE-2020-8124 (Insufficient validation and sanitization of user input exists in
 	NOTE: https://github.com/unshiftio/url-parse/commit/3ecd256f127c3ada36a84d9b8dd3ebd14316274b
 	NOTE: https://hackerone.com/reports/496293
 CVE-2020-8123 (A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that ...)
-	TODO: check
+	NOT-FOR-US: strapi
 CVE-2020-8122 (A missing check in Nextcloud Server 14.0.3 could give recipient the po ...)
 	- nextcloud-server <itp> (bug #941708)
 CVE-2020-8121 (A bug in Nextcloud Server 14.0.4 could expose more data in reshared li ...)
@@ -1098,7 +1098,7 @@ CVE-2020-8117 (Improper preservation of permissions in Nextcloud Server 14.0.3 c
 CVE-2020-8116 (Prototype pollution vulnerability in dot-prop npm package version 5.1. ...)
 	TODO: check
 CVE-2020-8115 (A reflected XSS vulnerability has been discovered in the publicly acce ...)
-	TODO: check
+	NOT-FOR-US: Revive Adserver
 CVE-2020-8114 (GitLab EE 8.9 and later through 12.7.2 has Insecure Permission ...)
 	- gitlab <unfixed>
 	NOTE: https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/
@@ -3688,7 +3688,7 @@ CVE-2020-6971
 CVE-2020-6970
 	RESERVED
 CVE-2020-6969 (It is possible to unmask credentials and other sensitive information o ...)
-	TODO: check
+	NOT-FOR-US: AutomationDirect
 CVE-2020-6968
 	RESERVED
 CVE-2020-6967
@@ -4149,7 +4149,7 @@ CVE-2020-6756 (languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-201506
 CVE-2020-6755
 	RESERVED
 CVE-2020-6754 (dotCMS before 5.2.4 is vulnerable to directory traversal, leading to i ...)
-	TODO: check
+	NOT-FOR-US: dotCMS
 CVE-2020-6753
 	RESERVED
 CVE-2020-6752
@@ -13140,7 +13140,7 @@ CVE-2020-3151
 CVE-2020-3150
 	RESERVED
 CVE-2020-3149 (A vulnerability in the web-based management interface of Cisco Identit ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2020-3148
 	RESERVED
 CVE-2020-3147 (A vulnerability in the web UI of Cisco Small Business Switches could a ...)
@@ -13198,11 +13198,11 @@ CVE-2020-3122
 CVE-2020-3121 (A vulnerability in the web-based management interface of Cisco Small B ...)
 	NOT-FOR-US: Cisco
 CVE-2020-3120 (A vulnerability in the Cisco Discovery Protocol implementation for Cis ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2020-3119 (A vulnerability in the Cisco Discovery Protocol implementation for Cis ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2020-3118 (A vulnerability in the Cisco Discovery Protocol implementation for Cis ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2020-3117
 	RESERVED
 CVE-2020-3116
@@ -13216,9 +13216,9 @@ CVE-2020-3113
 CVE-2020-3112
 	RESERVED
 CVE-2020-3111 (A vulnerability in the Cisco Discovery Protocol implementation for the ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2020-3110 (A vulnerability in the Cisco Discovery Protocol implementation for the ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2019-19770 (In the Linux kernel 4.19.83, there is a use-after-free (read) in the d ...)
 	- linux <unfixed>
 	NOTE: https://bugzilla.kernel.org/show_bug.cgi?id=205713
@@ -21565,15 +21565,15 @@ CVE-2020-0550
 	RESERVED
 CVE-2020-0549 (Cleanup errors in some data cache evictions for some Intel(R) Processo ...)
 	- intel-microcode <unfixed>
-	[buster] - intel-microcode <no-dsa> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
-	[stretch] - intel-microcode <no-dsa> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
+	[buster] - intel-microcode <postponed> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
+	[stretch] - intel-microcode <postponed> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
 	NOTE: https://software.intel.com/security-software-guidance/software-guidance/l1d-eviction-sampling
 	NOTE: https://cacheoutattack.com/
 	NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html
 CVE-2020-0548 (Cleanup errors in some Intel(R) Processors may allow an authenticated  ...)
 	- intel-microcode <unfixed>
-	[buster] - intel-microcode <no-dsa> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
-	[stretch] - intel-microcode <no-dsa> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
+	[buster] - intel-microcode <postponed> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
+	[stretch] - intel-microcode <postponed> (Minor issue; low impact if all mitigations for TAA and MDS were already previously applied)
 	NOTE: https://software.intel.com/security-software-guidance/software-guidance/vector-register-sampling
 	NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html
 CVE-2020-0547
@@ -28850,9 +28850,9 @@ CVE-2019-16206 (The authentication mechanism, in Brocade SANnav versions before
 CVE-2019-16205 (A vulnerability, in Brocade SANnav versions before v2.0, could allow r ...)
 	NOT-FOR-US: Brocade
 CVE-2019-16204 (Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1 ...)
-	TODO: check
+	NOT-FOR-US: Brocade Fabric OS
 CVE-2019-16203 (Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the ...)
-	TODO: check
+	NOT-FOR-US: Brocade Fabric OS
 CVE-2019-16202 (MISP before 2.4.115 allows privilege escalation in certain situations. ...)
 	NOT-FOR-US: MISP
 CVE-2019-16201 (WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5 ...)
@@ -31534,7 +31534,7 @@ CVE-2019-15255 (A vulnerability in the web-based management interface of Cisco I
 CVE-2019-15254
 	RESERVED
 CVE-2019-15253 (A vulnerability in the web-based management interface of Cisco Digital ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2019-15252 (Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapt ...)
 	NOT-FOR-US: Cisco
 CVE-2019-15251 (Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapt ...)
@@ -42200,7 +42200,7 @@ CVE-2019-12182
 CVE-2019-12181 (A privilege escalation vulnerability exists in SolarWinds Serv-U befor ...)
 	NOT-FOR-US: SolarWinds
 CVE-2019-12180 (An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0  ...)
-	TODO: check
+	NOT-FOR-US: SmartBear ReadyAPI
 CVE-2019-12179
 	RESERVED
 CVE-2019-12178



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/c61c1f9b75acb617d47bc25f7a6c4ea7e4b85957...55346ee796844d69d73abaf613ae099e37fd23b0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/c61c1f9b75acb617d47bc25f7a6c4ea7e4b85957...55346ee796844d69d73abaf613ae099e37fd23b0
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200205/e8a10ed0/attachment.html>

More information about the debian-security-tracker-commits mailing list