[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2017-1000600, CVE-2018-1000773/wordpress: jessie postponed + clarification

[Sylvain Beucler]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8ed14efd by Sylvain Beucler at 2020-02-21T18:39:21+01:00
CVE-2017-1000600,CVE-2018-1000773/wordpress: jessie postponed + clarification

- - - - -
df94c741 by Sylvain Beucler at 2020-02-21T18:39:21+01:00
dla: drop wordpress (postponed)

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -86442,6 +86442,7 @@ CVE-2018-1000800 (zephyr-rtos version 1.12.0 contains a NULL base pointer refere
 	NOT-FOR-US: zephyr-rtos
 CVE-2018-1000773 (WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation ...)
 	- wordpress <unfixed>
+	[jessie] - wordpress <postponed> (cf. CVE-2017-1000600)
 	NOTE: This CVE exists due to an incomplete fix in 4.9 for CVE-2017-1000600.
 CVE-2018-1000673
 	REJECTED
@@ -86479,10 +86480,12 @@ CVE-2018-1000658 (LimeSurvey version prior to 3.14.4 contains a file upload vuln
 	- limesurvey <itp> (bug #472802)
 CVE-2017-1000600 (WordPress version <4.9 contains a CWE-20 Input Validation vulnerabi ...)
 	- wordpress 4.9.1+dfsg-1
-	NOTE: https://www.securityfocus.com/bid/105305/references
+	[jessie] - wordpress <postponed> (requires authenticated user, root cause in PHP phar:// unserialization and requires thorough application-level checks, no upstream patch)
 	NOTE: https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/
 	NOTE: https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
-	NOTE: https://twitter.com/_s_n_t/status/1030573635617124353
+	NOTE: https://twitter.com/_s_n_t/status/1030573635617124353 (possible mitigation)
+	NOTE: https://www.slideshare.net/_s_n_t/php-unserialization-vulnerabilities-what-are-we-missing (75-76, pre-4.9 POP chain)
+	NOTE: https://github.com/WordPress/WordPress/commit/0a3b7d8e31def538cf531791efe8bf33e6e243cc (4.9 POP chain break)
 	NOTE: Wordpress before 4.9 is vulnerable on its own. After 4.9 you need to have
 	NOTE: vulnerable module installed on the site as well. Due to an incomplete fix
 	NOTE: in 4.9 there exists CVE-2018-1000773.


=====================================
data/dla-needed.txt
=====================================
@@ -99,10 +99,6 @@ tomcat8 (Abhijith PA)
 --
 weechat (Thorsten Alteholz)
 --
-wordpress
-  NOTE: 20200118: Maybe affected, needs deeper triaging, no obvious commits
-  NOTE: 20200118: referenced upstream. (sunweaver)
---
 wpa
   NOTE: 20200218: fix for CVE-2019-5061 removes IAPP functionality from hostapd, which is
   NOTE:           normally fine, but should be carefully considered for Jessie



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/def36a3ef3590f1ad762f37e93a8f26c53416501...df94c7414419c2f5696a7d1124a580fc2e4a2136

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/def36a3ef3590f1ad762f37e93a8f26c53416501...df94c7414419c2f5696a7d1124a580fc2e4a2136
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200221/b9925ecf/attachment-0001.html>