[Git][security-tracker-team/security-tracker][master] 2 commits: Track drupal7 as well under CVE-2020-2894{8,9}

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f27c42fb by Salvatore Bonaccorso at 2020-11-26T08:23:20+01:00
Track drupal7 as well under CVE-2020-2894{8,9}

The drupal project seems to reuse the CVes as well for the respective
affecting issues in the drupal code base. Follow that for now.

- - - - -
4a6a446f by Salvatore Bonaccorso at 2020-11-26T08:24:32+01:00
DLA-2644: Reference CVE-2020-28948 and CVE-2020-28949

- - - - -


2 changed files:

- data/CVE/list
- data/DLA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -270,14 +270,18 @@ CVE-2020-28950
 	RESERVED
 CVE-2020-28949 (Archive_Tar through 1.4.10 has :// filename sanitization only to addre ...)
 	{DLA-2465-1}
+	- drupal7 <removed>
 	- php-pear <unfixed>
 	NOTE: https://github.com/pear/Archive_Tar/issues/33
 	NOTE: https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da
+	NOTE: https://www.drupal.org/sa-core-2020-013
 CVE-2020-28948 (Archive_Tar through 1.4.10 allows an unserialization attack because ph ...)
 	{DLA-2465-1}
+	- drupal7 <removed>
 	- php-pear <unfixed>
 	NOTE: https://github.com/pear/Archive_Tar/issues/33
 	NOTE: https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da
+	NOTE: https://www.drupal.org/sa-core-2020-013
 CVE-2020-28947 (In MISP 2.4.134, XSS exists in the template element index view because ...)
 	NOT-FOR-US: MISP
 CVE-2020-28946


=====================================
data/DLA/list
=====================================
@@ -1,4 +1,5 @@
 [26 Nov 2020] DLA-2466-1 drupal7 - security update
+	{CVE-2020-28948 CVE-2020-28949}
 	[stretch] - drupal7 7.52-2+deb9u13
 [23 Nov 2020] DLA-2465-1 php-pear - security update
 	{CVE-2020-28948 CVE-2020-28949}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2160a66d1e01901eccdf917e0acb0dc81d9c9671...4a6a446f0c1f609b787acde256a5852988ac2f91

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2160a66d1e01901eccdf917e0acb0dc81d9c9671...4a6a446f0c1f609b787acde256a5852988ac2f91
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20201126/2f8c7400/attachment-0001.html>