[Git][security-tracker-team/security-tracker][master] Update information for CVE-2021-22925

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d417e203 by Salvatore Bonaccorso at 2021-07-21T20:53:47+02:00
Update information for CVE-2021-22925

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -33737,10 +33737,13 @@ CVE-2021-22926
 	RESERVED
 CVE-2021-22925 [TELNET stack contents disclosure again]
 	RESERVED
-	- curl <unfixed>
+	- curl <not-affected> (Incomplete fix for CVE-2021-22898 not applied)
 	NOTE: https://curl.se/docs/CVE-2021-22925.html
-	NOTE: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a
+	NOTE: Introduced by: https://github.com/curl/curl/commit/a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4 (curl-7_7_alpha2)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a (curl-7_78_0)
 	NOTE: https://www.openwall.com/lists/oss-security/2021/07/21/4
+	NOTE: CVE is assigned because previous attempt to address CVE-2021-22898 resulted to be
+	NOTE: insufficient and the security vulnerability remained.
 CVE-2021-22924 [Bad connection reuse due to flawed path name checks]
 	RESERVED
 	- curl <unfixed>
@@ -33834,6 +33837,8 @@ CVE-2021-22898 (curl 7.7 through 7.76.1 suffers from an information disclosure w
 	NOTE: https://curl.se/docs/CVE-2021-22898.html
 	NOTE: Introduced by: https://github.com/curl/curl/commit/a1d6ad26100bc493c7b04f1301b1634b7f5aa8b4 (7.7)
 	NOTE: Fixed by: https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde (7.77.0)
+	NOTE: Followup to not make curl vulnerable to CVE-2021-22925:
+	NOTE: https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a (curl-7_78_0)
 CVE-2021-22897 (curl 7.61.0 through 7.76.1 suffers from exposure of data element to wr ...)
 	- curl <not-affected> (Windows only)
 	NOTE: https://curl.se/docs/CVE-2021-22897.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d417e20348f4904edc5d994c49b6641556e8aa05

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d417e20348f4904edc5d994c49b6641556e8aa05
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210721/0e5d5f31/attachment.htm>