[Git][security-tracker-team/security-tracker][master] update apache2 CVE notes with commit references

[Roberto C. Sánchez (@roberto)]

Roberto C. Sánchez pushed to branch master at Debian Security Tracker / security-tracker


Commits:
dee9682f by Roberto C. Sánchez at 2022-06-18T20:13:57-04:00
update apache2 CVE notes with commit references

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5145,6 +5145,7 @@ CVE-2022-31813 (Apache HTTP Server 2.4.53 and earlier may not send the X-Forward
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/8
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-31813
+	NOTE: https://github.com/apache/httpd/commit/956f708b094698ac9ad570d640d4f30eb0df7305
 CVE-2022-31812
 	RESERVED
 CVE-2022-31811
@@ -8821,6 +8822,7 @@ CVE-2022-30556 (Apache HTTP Server 2.4.53 and earlier may return lengths to appl
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/7
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-30556
+	NOTE: https://github.com/apache/httpd/commit/3a561759fcb37af179585adb8478922dc9bc6a85
 CVE-2022-30555
 	RESERVED
 CVE-2022-30554
@@ -9002,6 +9004,8 @@ CVE-2022-30522 (If Apache HTTP Server 2.4.53 is configured to do transformations
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/6
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-30522
+	NOTE: https://github.com/apache/httpd/commit/db47781128e42bd49f55076665b3f6ca4e2bc5e2
+	NOTE: https://github.com/apache/httpd/commit/96c75bba15b6ce20eb8d34aad717a046c000b233
 CVE-2022-1642 (A program using swift-corelibs-foundation is vulnerable to a denial of ...)
 	TODO: check
 CVE-2022-1641
@@ -12302,6 +12306,7 @@ CVE-2022-29404 (In Apache HTTP Server 2.4.53 and earlier, a malicious request to
 	- apache2 2.4.54-1 (bug #1012513)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/5
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-29404
+	NOTE: https://github.com/apache/httpd/commit/ce259c4061905bf834f9af51c92456cfe8335ddc
 CVE-2022-1381 (global heap buffer overflow in skip_range in GitHub repository vim/vim ...)
 	- vim 2:8.2.4793-1
 	[bullseye] - vim <no-dsa> (Minor issue)
@@ -14508,12 +14513,14 @@ CVE-2022-28615 (Apache HTTP Server 2.4.53 and earlier may crash or disclose info
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/9
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-28615
+	NOTE: https://github.com/apache/httpd/commit/6503d09ab51047554c384a6d03646ce1a8848120
 CVE-2022-28614 (The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may  ...)
 	- apache2 2.4.54-1 (bug #1012513)
 	[bullseye] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/4
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-28614
+	NOTE: https://github.com/apache/httpd/commit/8c14927162cf3b4f810683e1c5505e9ef9e1f123
 CVE-2022-28613 (A vulnerability in the HCI Modbus TCP COMPONENT of Hitachi Energy RTU5 ...)
 	NOT-FOR-US: HCI Modbus TCP COMPONENT of Hitachi Energy RTU500 series CMU Firmware
 CVE-2022-28610
@@ -20998,6 +21005,7 @@ CVE-2022-26377 (Inconsistent Interpretation of HTTP Requests ('HTTP Request Smug
 	[buster] - apache2 <no-dsa> (Minor issue; can be fixed in point release)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/06/08/2
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-26377
+	NOTE: https://github.com/apache/httpd/commit/f7f15f3d8bfe3032926c8c39eb8434529f680bd4
 CVE-2022-26073 (A denial of service vulnerability exists in the libxm_av.so DemuxCmdIn ...)
 	NOT-FOR-US: Anker Eufy Homebase
 CVE-2022-25989 (An authentication bypass vulnerability exists in the libxm_av.so getpe ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee9682f1fe4d2de0ca88fa71c12788b9bd4a8be

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee9682f1fe4d2de0ca88fa71c12788b9bd4a8be
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220619/d78a821c/attachment-0001.htm>