[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2017-1000600, CVE-2018-1000773/wordpress: jessie postponed + clarification
Sylvain Beucler
beuc at debian.org
Fri Feb 21 17:41:34 GMT 2020
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8ed14efd by Sylvain Beucler at 2020-02-21T18:39:21+01:00
CVE-2017-1000600,CVE-2018-1000773/wordpress: jessie postponed + clarification
- - - - -
df94c741 by Sylvain Beucler at 2020-02-21T18:39:21+01:00
dla: drop wordpress (postponed)
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -86442,6 +86442,7 @@ CVE-2018-1000800 (zephyr-rtos version 1.12.0 contains a NULL base pointer refere
NOT-FOR-US: zephyr-rtos
CVE-2018-1000773 (WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation ...)
- wordpress <unfixed>
+ [jessie] - wordpress <postponed> (cf. CVE-2017-1000600)
NOTE: This CVE exists due to an incomplete fix in 4.9 for CVE-2017-1000600.
CVE-2018-1000673
REJECTED
@@ -86479,10 +86480,12 @@ CVE-2018-1000658 (LimeSurvey version prior to 3.14.4 contains a file upload vuln
- limesurvey <itp> (bug #472802)
CVE-2017-1000600 (WordPress version <4.9 contains a CWE-20 Input Validation vulnerabi ...)
- wordpress 4.9.1+dfsg-1
- NOTE: https://www.securityfocus.com/bid/105305/references
+ [jessie] - wordpress <postponed> (requires authenticated user, root cause in PHP phar:// unserialization and requires thorough application-level checks, no upstream patch)
NOTE: https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/
NOTE: https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
- NOTE: https://twitter.com/_s_n_t/status/1030573635617124353
+ NOTE: https://twitter.com/_s_n_t/status/1030573635617124353 (possible mitigation)
+ NOTE: https://www.slideshare.net/_s_n_t/php-unserialization-vulnerabilities-what-are-we-missing (75-76, pre-4.9 POP chain)
+ NOTE: https://github.com/WordPress/WordPress/commit/0a3b7d8e31def538cf531791efe8bf33e6e243cc (4.9 POP chain break)
NOTE: Wordpress before 4.9 is vulnerable on its own. After 4.9 you need to have
NOTE: vulnerable module installed on the site as well. Due to an incomplete fix
NOTE: in 4.9 there exists CVE-2018-1000773.
=====================================
data/dla-needed.txt
=====================================
@@ -99,10 +99,6 @@ tomcat8 (Abhijith PA)
--
weechat (Thorsten Alteholz)
--
-wordpress
- NOTE: 20200118: Maybe affected, needs deeper triaging, no obvious commits
- NOTE: 20200118: referenced upstream. (sunweaver)
---
wpa
NOTE: 20200218: fix for CVE-2019-5061 removes IAPP functionality from hostapd, which is
NOTE: normally fine, but should be carefully considered for Jessie
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/def36a3ef3590f1ad762f37e93a8f26c53416501...df94c7414419c2f5696a7d1124a580fc2e4a2136
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/def36a3ef3590f1ad762f37e93a8f26c53416501...df94c7414419c2f5696a7d1124a580fc2e4a2136
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200221/b9925ecf/attachment-0001.html>
More information about the debian-security-tracker-commits
mailing list