[Git][security-tracker-team/security-tracker][master] new ruby-doorkeeper issue
Moritz Muehlenhoff
jmm at debian.org
Wed May 6 17:49:56 BST 2020
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9b610973 by Moritz Muehlenhoff at 2020-05-06T18:49:38+02:00
new ruby-doorkeeper issue
new kfreebsd issues
new vbox issue
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -12,7 +12,7 @@ CVE-2020-12668
CVE-2020-12667
RESERVED
CVE-2020-12666 (macaron before 1.3.7 has an open redirect in the static handler, as de ...)
- TODO: check
+ NOT-FOR-US: macaron
CVE-2020-12665
RESERVED
CVE-2020-12664
@@ -1376,7 +1376,7 @@ CVE-2020-12137 (GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubb
NOTE: https://www.openwall.com/lists/oss-security/2020/02/24/2
NOTE: http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1801
CVE-2020-12079 (Beaker before 0.8.9 allows a sandbox escape, enabling system access an ...)
- TODO: check
+ NOT-FOR-US: Beaker browser, different from src:beaker
CVE-2020-12078 (An issue was discovered in Open-AudIT 3.3.1. There is shell metacharac ...)
NOT-FOR-US: Open-AudIT
CVE-2020-12077 (The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPr ...)
@@ -2979,14 +2979,12 @@ CVE-2020-11765 (An issue was discovered in OpenEXR before 2.4.1. There is an off
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/3eda5d70aba127bae9bd6bae9956fcf024b64031
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/2ae5f8376b0a6c3e2bb100042f5de79503ba837a
- TODO: check correctness
CVE-2020-11764 (An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bo ...)
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/e7c26f6ef5bf7ae8ea21ecf19963186cd1391720
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/a6408c90339bdf19f89476578d7f936b741be9b2
- TODO: check correctness
CVE-2020-11763 (An issue was discovered in OpenEXR before 2.4.1. There is an std::vect ...)
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -2998,19 +2996,16 @@ CVE-2020-11762 (An issue was discovered in OpenEXR before 2.4.1. There is an out
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/3eda5d70aba127bae9bd6bae9956fcf024b64031
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/2ae5f8376b0a6c3e2bb100042f5de79503ba837a
- TODO: check correctness
CVE-2020-11761 (An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bo ...)
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/b1c34c496b62117115b1089b18a44e0031800a09
- TODO: check correctness
CVE-2020-11760 (An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bo ...)
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/37750013830def57f19f3c3b7faaa9fc1dae81b3
- TODO: check correctness
CVE-2020-11759 (An issue was discovered in OpenEXR before 2.4.1. Because of integer ov ...)
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -3887,7 +3882,7 @@ CVE-2020-11530
CVE-2020-11529 (Common/Grav.php in Grav before 1.6.23 has an Open Redirect. ...)
NOT-FOR-US: Grav CMS
CVE-2020-11528 (bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) ...)
- TODO: check
+ NOT-FOR-US: bit2spr
CVE-2020-11527 (In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated rem ...)
NOT-FOR-US: Zoho
CVE-2020-11526
@@ -4031,7 +4026,7 @@ CVE-2020-11464 (An issue was discovered in Deskpro before 2019.8.0. The /api/peo
CVE-2020-11463 (An issue was discovered in Deskpro before 2019.8.0. The /api/email_acc ...)
NOT-FOR-US: Deskpro
CVE-2020-11462 (An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8. ...)
- TODO: check
+ NOT-FOR-US: OpenVPN Access Server
CVE-2020-11461
RESERVED
CVE-2020-11460
@@ -4895,7 +4890,7 @@ CVE-2020-11053
CVE-2020-11052
RESERVED
CVE-2020-11051 (In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor ...)
- TODO: check
+ NOT-FOR-US: Wiki.js
CVE-2020-11050
RESERVED
CVE-2020-11049
@@ -4995,7 +4990,7 @@ CVE-2020-11022 (In jQuery versions greater than or equal to 1.2 and before 3.5.0
NOTE: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
NOTE: https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
CVE-2020-11021 (Actions Http-Client (NPM @actions/http-client) before version 1.0.8 ca ...)
- TODO: check
+ NOT-FOR-US: Actions Http-Client
CVE-2020-11020 (Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1. ...)
- ruby-faye <unfixed> (bug #959392)
NOTE: https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
@@ -5015,13 +5010,13 @@ CVE-2020-11014 (Electron-Cash-SLP before version 3.6.2 has a vulnerability. All
CVE-2020-11013 (Their is an information disclosure vulnerability in Helm from version ...)
- helm-kubernetes <itp> (bug #910799)
CVE-2020-11012 (MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authenticat ...)
- TODO: check
+ NOT-FOR-US: MinIO
CVE-2020-11011 (In Phproject before version 1.7.8, there's a vulnerability which allow ...)
NOT-FOR-US: Phproject
CVE-2020-11010 (In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of S ...)
NOT-FOR-US: Tortoise ORM
CVE-2020-11009 (In Rundeck before version 3.2.6, authenticated users can craft a reque ...)
- TODO: check
+ NOT-FOR-US: Rundeck
CVE-2020-11008 (Affected versions of Git have a vulnerability whereby Git can be trick ...)
{DSA-4659-1 DLA-2182-1}
- git 1:2.26.2-1
@@ -5062,7 +5057,7 @@ CVE-2020-10997 (Percona XtraBackup before 2.4.20 unintentionally writes the comm
NOTE: Introduced in: https://github.com/percona/percona-xtrabackup/commit/0b38ffc0f30f1b6d3ff7ed0f9cb3ab31a2ccad13 (percona-xtrabackup-2.4.11)
NOTE: https://www.percona.com/blog/2020/04/16/cve-2020-10997-percona-xtrabackup-information-disclosure-of-command-line-arguments/
CVE-2020-10996 (An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.42. ...)
- TODO: check
+ NOT-FOR-US: Percona XtraDB Cluster
CVE-2020-10995
RESERVED
CVE-2020-10994
@@ -5429,7 +5424,7 @@ CVE-2020-10861 (An issue was discovered in Avast Antivirus before 20. The aswTas
CVE-2020-10860 (An issue was discovered in Avast Antivirus before 20. An Arbitrary Mem ...)
NOT-FOR-US: Avast Antivirus
CVE-2020-10859 (Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2020-10858
RESERVED
CVE-2020-10857
@@ -6284,7 +6279,7 @@ CVE-2020-10636
CVE-2020-10635
RESERVED
CVE-2020-10634 (SAE IT-systems FW-50 Remote Telemetry Unit (RTU). A specially crafted ...)
- TODO: check
+ NOT-FOR-US: SAE IT-systems FW-50 Remote Telemetry Unit
CVE-2020-10633 (A non-persistent XSS (cross-site scripting) vulnerability exists in eW ...)
NOT-FOR-US: eWON Flexy and Cosy
CVE-2020-10632
@@ -6292,7 +6287,7 @@ CVE-2020-10632
CVE-2020-10631 (An attacker could use a specially crafted URL to delete or read files ...)
NOT-FOR-US: WebAccess/NMS
CVE-2020-10630 (SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does no ...)
- TODO: check
+ NOT-FOR-US: SAE IT-systems FW-50 Remote Telemetry Unit
CVE-2020-10629 (WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. S ...)
NOT-FOR-US: WebAccess/NMS
CVE-2020-10628
@@ -7258,7 +7253,11 @@ CVE-2019-20503 (usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_a
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1992
NOTE: https://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467
CVE-2020-10187 (Doorkeeper version 5.0.0 and later contains an information disclosure ...)
- TODO: check
+ - ruby-doorkeeper <unfixed>
+ NOTE: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
+ NOTE: https://github.com/doorkeeper-gem/doorkeeper/releases
+ NOTE: https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
+ NOTE: https://github.com/rubysec/ruby-advisory-db/pull/446
CVE-2020-10186
RESERVED
CVE-2020-10185 (The sync endpoint in YubiKey Validation Server before 2.40 allows remo ...)
@@ -10213,7 +10212,7 @@ CVE-2020-8898
CVE-2020-8897
RESERVED
CVE-2020-8896 (A Buffer Overflow vulnerability in the khcrypt implementation in Googl ...)
- TODO: check
+ NOT-FOR-US: Google Earth Pro
CVE-2020-8895 (Untrusted Search Path vulnerability in the windows installer of Google ...)
NOT-FOR-US: windows installer of Google Earth Pro
CVE-2020-8894 (An issue was discovered in MISP before 2.4.121. ACLs for discussion th ...)
@@ -10382,7 +10381,7 @@ CVE-2020-8834 (KVM in the Linux kernel on Power8 processors has a conflicting us
[jessie] - linux <not-affected> (Vulnerable code not present)
NOTE: https://www.openwall.com/lists/oss-security/2020/04/06/2
CVE-2020-8833 (Time-of-check Time-of-use Race Condition vulnerability on crash report ...)
- TODO: check
+ NOT-FOR-US: Apport
CVE-2020-8832 (The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 (" ...)
- linux 4.16.5-1
[jessie] - linux <not-affected> (No support for this hardware)
@@ -10399,9 +10398,9 @@ CVE-2019-20451 (The HTTP API in Prismview System 9 11.10.17.00 and Prismview Pla
CVE-2017-18642 (Syska Smart Bulb devices through 2017-08-06 receive RGB parameters ove ...)
NOT-FOR-US: Syska Smart Bulb devices
CVE-2020-8830 (CSRF in login.asp on Ruckus devices allows an attacker to access the p ...)
- TODO: check
+ NOT-FOR-US: Ruckus
CVE-2020-8829 (CSRF on Intelbras CIP 92200 devices allows an attacker to access the p ...)
- TODO: check
+ NOT-FOR-US: Intelbras
CVE-2020-8828 (As of v1.5.0, the default admin password is set to the argocd-server p ...)
NOT-FOR-US: Argo
CVE-2020-8827 (As of v1.5.0, the Argo API does not implement anti-automation measures ...)
@@ -12184,7 +12183,7 @@ CVE-2020-8035
CVE-2020-8034
RESERVED
CVE-2020-8033 (Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Nam ...)
- TODO: check
+ NOT-FOR-US: Ruckus
CVE-2020-8032
RESERVED
CVE-2020-8031
@@ -12214,7 +12213,7 @@ CVE-2020-8020
CVE-2020-8019
RESERVED
CVE-2020-8018 (A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST- ...)
- TODO: check
+ NOT-FOR-US: Some SLES images
CVE-2020-8017 (A Race Condition Enabling Link Following vulnerability in the cron job ...)
NOT-FOR-US: SuSE packaging of TexLive
CVE-2020-8016 (A Race Condition Enabling Link Following vulnerability in the packagin ...)
@@ -12296,7 +12295,7 @@ CVE-2020-7985
CVE-2020-7984 (SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allow ...)
NOT-FOR-US: SolarWinds
CVE-2020-7983 (A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows re ...)
- TODO: check
+ NOT-FOR-US: Ruckus
CVE-2019-20432 (In the Lustre file system before 2.12.3, the mdt module has an out-of- ...)
- lustre <removed>
CVE-2019-20431 (In the Lustre file system before 2.12.3, the ptlrpc module has an osd_ ...)
@@ -13139,9 +13138,9 @@ CVE-2020-7647
CVE-2020-7646
RESERVED
CVE-2020-7645 (All versions of chrome-launcher allow execution of arbitrary commands, ...)
- TODO: check
+ NOT-FOR-US: Node chrome-launcher
CVE-2020-7644 (fun-map through 3.3.1 is vulnerable to Prototype Pollution. The functi ...)
- TODO: check
+ NOT-FOR-US: Node fun-map
CVE-2020-7643 (paypal-adaptive through 0.4.2 manipulation of JavaScript objects resul ...)
NOT-FOR-US: Node paypal-adaptive
CVE-2020-7642 (lazysizes through 5.2.0 allows execution of malicious JavaScript. The ...)
@@ -13149,7 +13148,7 @@ CVE-2020-7642 (lazysizes through 5.2.0 allows execution of malicious JavaScript.
CVE-2020-7641
RESERVED
CVE-2020-7640 (pixl-class prior to 1.0.3 allows execution of arbitrary commands. The ...)
- TODO: check
+ NOT-FOR-US: Node pixl-class
CVE-2020-7639 (eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.T ...)
NOT-FOR-US: Node eivindfjeldstad-dot
CVE-2020-7638 (confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDe ...)
@@ -13216,7 +13215,7 @@ CVE-2020-7610 (All versions of bson before 1.1.4 are vulnerable to Deserializati
NOTE: https://snyk.io/vuln/SNYK-JS-BSON-561052
NOTE: https://github.com/mongodb/js-bson/commit/3809c1313a7b2a8001065f0271199df9fa3d16a8
CVE-2020-7609 (node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbi ...)
- TODO: check
+ NOT-FOR-US: Node node-rules
CVE-2020-7608 (yargs-parser could be tricked into adding or modifying properties of O ...)
- node-yargs-parser 18.1.1-1
[buster] - node-yargs-parser <no-dsa> (Minor issue; can be fixed via point release)
@@ -13565,11 +13564,13 @@ CVE-2020-7455
CVE-2020-7454
RESERVED
CVE-2020-7453 (In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEAS ...)
- TODO: check
+ - kfreebsd-10 <unfixed> (unimportant)
+ NOTE: https://www.freebsd.org/security/advisories/FreeBSD-SA-20:08.jail.asc
CVE-2020-7452 (In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEAS ...)
- TODO: check
+ - kfreebsd-10 <unfixed> (unimportant)
+ NOTE: https://www.freebsd.org/security/advisories/FreeBSD-SA-20:07.epair.asc
CVE-2020-7451 (In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEAS ...)
- TODO: check
+ NOT-FOR-US: FreeBSD
CVE-2020-7450 (In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEAS ...)
NOT-FOR-US: FreeBSD
CVE-2020-7449
@@ -13769,7 +13770,7 @@ CVE-2020-7353
CVE-2020-7352
RESERVED
CVE-2020-7351 (An OS Command Injection vulnerability in the endpoint_devicemap.php co ...)
- TODO: check
+ NOT-FOR-US: Fonality Trixbox Community Edition
CVE-2020-7350 (Rapid7 Metasploit Framework versions before 5.0.85 suffers from an ins ...)
NOT-FOR-US: Rapid7 Metasploit Framework
CVE-2020-7349
@@ -14259,7 +14260,7 @@ CVE-2020-7137
CVE-2020-7136 (A security vulnerability in HPE Smart Update Manager (SUM) prior to ve ...)
NOT-FOR-US: HPE Smart Update Manager (SUM)
CVE-2020-7135 (A potential security vulnerability has been identified in the disk dri ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2020-7134 (A remote access to sensitive data vulnerability was discovered in HPE ...)
NOT-FOR-US: HPE
CVE-2020-7133 (A unauthorized remote access vulnerability was discovered in HPE IOT + ...)
@@ -17650,7 +17651,7 @@ CVE-2020-5729 (In OpenMRS 2.9 and prior, the UI Framework Error Page reflects ar
CVE-2020-5728 (OpenMRS 2.9 and prior copies "Referrer" header values into an html ele ...)
NOT-FOR-US: OpenMRS
CVE-2020-5727 (Authentication bypass using an alternate path or channel in SimpliSafe ...)
- TODO: check
+ NOT-FOR-US: SimpliSafe
CVE-2020-5726 (The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQ ...)
NOT-FOR-US: Grandstream
CVE-2020-5725 (The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQ ...)
@@ -18076,7 +18077,7 @@ CVE-2016-11017 (The application login page in AKIPS Network Monitor 15.37 throug
CVE-2020-5518
RESERVED
CVE-2020-5517 (CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access ...)
- TODO: check
+ NOT-FOR-US: BlueOnyx
CVE-2020-5516
RESERVED
CVE-2020-5515 (Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. ...)
@@ -26089,7 +26090,8 @@ CVE-2020-2577 (Vulnerability in the MySQL Server product of Oracle MySQL (compon
CVE-2020-2576 (Vulnerability in the Oracle Outside In Technology product of Oracle Fu ...)
NOT-FOR-US: Oracle
CVE-2020-2575 (Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualiza ...)
- TODO: check
+ - virtualbox 6.1.6-dfsg-1
+ [jessie] - virtualbox <end-of-life> (DSA-3699-1)
CVE-2020-2574 (Vulnerability in the MySQL Client product of Oracle MySQL (component: ...)
- mysql-5.7 <unfixed> (bug #949994)
- mariadb-10.3 1:10.3.22-1
@@ -28076,13 +28078,13 @@ CVE-2020-1926
CVE-2020-1925 (Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperI ...)
NOT-FOR-US: Olingo
CVE-2019-19517 (Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html for ...)
- TODO: check
+ NOT-FOR-US: Intelbras
CVE-2019-19516 (Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp ...)
NOT-FOR-US: Intelbras WRN
CVE-2019-19515 (Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireles ...)
- TODO: check
+ NOT-FOR-US: Ayision
CVE-2019-19514 (Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic r ...)
- TODO: check
+ NOT-FOR-US: Ayision
CVE-2019-19513
RESERVED
CVE-2020-1924
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9b61097377f0dd8bf32dde962abb51b3e40fc27d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9b61097377f0dd8bf32dde962abb51b3e40fc27d
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200506/8aa60d21/attachment-0001.html>
More information about the debian-security-tracker-commits
mailing list