[Git][security-tracker-team/security-tracker][master] 2 commits: Update note for CVE-2020-1957 in hiro after upstream investigation.

[Chris Lamb]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
307848b6 by Chris Lamb at 2020-03-28T09:32:39+00:00
Update note for CVE-2020-1957 in hiro after upstream investigation.

- - - - -
28f1f7cd by Chris Lamb at 2020-03-28T09:32:46+00:00
Triage CVE-2020-1957 in shiro for jessie LTS.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -22294,7 +22294,10 @@ CVE-2020-1958
 	RESERVED
 CVE-2020-1957 (Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic ...)
 	- shiro <unfixed> (bug #955018)
+	[jessie] - shiro <not-affected> (Vulnerable code not present)
 	NOTE: https://www.openwall.com/lists/oss-security/2020/03/23/2
+	NOTE: Possibly introduced in https://github.com/lamby/shiro/commit/a380b7d27be549e612d11ee04a84ac177677323c (1.5.0+)
+	NOTE: Possible fix at https://github.com/apache/shiro/pull/203
 CVE-2020-1956
 	RESERVED
 CVE-2020-1955



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e17683e2ddbb47e2188e36806c1d582811696cca...28f1f7cd6057e52bb888159baa4e1d78b0603e1d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e17683e2ddbb47e2188e36806c1d582811696cca...28f1f7cd6057e52bb888159baa4e1d78b0603e1d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200328/2516a941/attachment.html>