[Git][security-tracker-team/security-tracker][master] Add CVE-2021-23383/node-handlebars

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9a2712b9 by Salvatore Bonaccorso at 2021-05-04T22:18:16+02:00
Add CVE-2021-23383/node-handlebars

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -20097,8 +20097,13 @@ CVE-2021-23385
 	RESERVED
 CVE-2021-23384
 	RESERVED
-CVE-2021-23383
+CVE-2021-23383 [Prototype Pollution]
 	RESERVED
+	- node-handlebars <unfixed>
+	[buster] - node-handlebars <no-dsa> (Minor issue; can be fixed via point release)
+	- libjs-handlebars <removed>
+	NOTE: https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
+	NOTE: https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
 CVE-2021-23382 (The package postcss before 8.2.13 are vulnerable to Regular Expression ...)
 	- node-postcss 8.2.1+~cs5.3.23-7
 	NOTE: https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a2712b91538a392c034630e1d2c2ec3fded0702

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a2712b91538a392c034630e1d2c2ec3fded0702
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210504/161ba0dd/attachment.htm>