[Git][security-tracker-team/security-tracker][master] checkinstall non issue

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f897dba9 by Moritz Muehlenhoff at 2020-09-01T09:23:42+02:00
checkinstall non issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -22,8 +22,10 @@ CVE-2020-25032 (An issue was discovered in Flask-CORS (aka CORS Middleware for F
 	- python-flask-cors <unfixed>
 	NOTE: https://github.com/corydolphin/flask-cors/commit/67c4b2cc98ae87cf1fa7df4f97fd81b40c79b895
 CVE-2020-25031 (checkinstall 1.6.2, when used to create a package that contains a syml ...)
-	- checkinstall <unfixed>
+	- checkinstall <unfixed> (unimportant)
 	NOTE: https://bugs.launchpad.net/ubuntu/+source/checkinstall/+bug/1861281
+	NOTE: Does not cross any reasonable trust boundary, the packages to be installed need to be
+	NOTE: trusted to begin with, a rogue package can cause more harm than a 777 binary
 CVE-2020-25030
 	RESERVED
 CVE-2020-25029



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f897dba9d4ed93bfbb5373d6d508e8ae47bfd13a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f897dba9d4ed93bfbb5373d6d508e8ae47bfd13a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200901/31871676/attachment.html>