[Git][security-tracker-team/security-tracker][master] 3 commits: CVE-2019-10241/jetty: reference issue with patches

[Sylvain Beucler]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6d0b31b1 by Sylvain Beucler at 2021-05-04T17:03:12+02:00
CVE-2019-10241/jetty: reference issue with patches

- - - - -
1bbb4b03 by Sylvain Beucler at 2021-05-04T17:03:13+02:00
CVE-2018-12536/jetty: more references

- - - - -
654d4e51 by Sylvain Beucler at 2021-05-04T17:03:14+02:00
CVE-2019-17632/jetty: none affected

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -113356,13 +113356,15 @@ CVE-2019-17633 (For Eclipse Che versions 6.16 to 7.3.0, with both authentication
 	NOT-FOR-US: Eclipse Che
 CVE-2019-17632 (In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4. ...)
 	- jetty9 9.4.26-1
-	[buster] - jetty9 <no-dsa> (Minor issue)
-	[stretch] - jetty9 <no-dsa> (Minor issue)
+	[buster] - jetty9 <not-affected> (vulnerable code introduced later)
+	[stretch] - jetty9 <not-affected> (vulnerable code introduced later)
 	- jetty8 <removed>
 	[jessie] - jetty8 <not-affected> (vulnerable code introduced later)
 	- jetty <removed>
 	[jessie] - jetty <not-affected> (vulnerable code introduced later)
 	NOTE: https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443
+	NOTE: https://github.com/eclipse/jetty.project/issues/4334
+	NOTE: Introduced by https://github.com/eclipse/jetty.project/commit/bde86467f4e5df595773ab11ed5e80c615b741f3 (jetty-9.4.21.v20190926)
 CVE-2019-17631 (From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such ...)
 	NOT-FOR-US: Eclipse OpenJ9
 CVE-2019-17630 (CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a cra ...)
@@ -136459,6 +136461,7 @@ CVE-2019-10241 (In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and
 	- jetty <removed>
 	[jessie] - jetty <no-dsa> (Minor issue)
 	NOTE: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121
+	NOTE: https://github.com/eclipse/jetty.project/issues/3319#issuecomment-567918620
 CVE-2019-10240 (Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifac ...)
 	NOT-FOR-US: Eclipse hawkBit
 CVE-2017-18365 (The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a d ...)
@@ -184244,6 +184247,9 @@ CVE-2018-12536 (In Eclipse Jetty Server, all 9.x versions, on webapps deployed u
 	- jetty <removed>
 	[jessie] - jetty <ignored> (Harmless information leak)
 	NOTE: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
+	NOTE: https://github.com/eclipse/jetty.project/issues/2560
+	NOTE: Introduced by https://github.com/eclipse/jetty.project/commit/9f844383cdb528d67ec69895dd8c6117b6e36e13 (v9.3)
+	NOTE: Marked as fixed by 9.2.25 at https://www.eclipse.org/jetty/security_reports.php but no related commit found for 9.2.x
 CVE-2018-12535
 	RESERVED
 CVE-2018-12534 (A SQL injection issue was discovered in the Quick Chat plugin before 4 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cbe16ef5d2b1906a4910c01fbb204eff795eb890...654d4e517e3067c7a807a695a261b0ec6740c4fc

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cbe16ef5d2b1906a4910c01fbb204eff795eb890...654d4e517e3067c7a807a695a261b0ec6740c4fc
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210504/7cbe586d/attachment.htm>