[Git][security-tracker-team/security-tracker][master] Update references for CVE-2020-5398

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d82b6717 by Salvatore Bonaccorso at 2020-02-26T23:07:57+01:00
Update references for CVE-2020-5398

https://pivotal.io/security/cve-2020-5398 refers to
https://github.com/spring-projects/spring-framework/issues/24220 . An
application is vulnerable when a set of condition is fulfilled,
including when the filename is derived from user supplied input, which
is not sanitized.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -8952,8 +8952,9 @@ CVE-2020-5399 (Cloud Foundry CredHub, versions prior to 2.5.10, connects to a My
 CVE-2020-5398 (In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x pri ...)
 	- libspring-java <unfixed>
 	NOTE: https://pivotal.io/security/cve-2020-5398
-	NOTE: https://github.com/spring-projects/spring-framework/issues/24238
-	NOTE: https://github.com/spring-projects/spring-framework/commit/f9c1565f4ef031904c3545a70e63080aeade6e90
+	NOTE: https://github.com/spring-projects/spring-framework/issues/24220
+	NOTE: https://github.com/spring-projects/spring-framework/commit/41f40c6c229d3b4f768718f1ec229d8f0ad76d76
+	NOTE: https://github.com/spring-projects/spring-framework/commit/956ffe68587c8d5f21135b5ce4650af0c2dea933
 CVE-2020-5397 (Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF ...)
 	- libspring-java <unfixed>
 	[jessie] - libspring-java <not-affected> (Vulnerable code not present)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d82b671707fbe81d6d5447ea70c7a0b9edbbec91

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d82b671707fbe81d6d5447ea70c7a0b9edbbec91
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200226/595812ab/attachment.html>