[Git][security-tracker-team/security-tracker][master] 2 commits: Process 1 NFU

[Neil Williams (@codehelp)]

Neil Williams pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ef0adafc by Neil Williams at 2022-05-26T09:00:43+01:00
Process 1 NFU

- - - - -
b7c8cb5d by Neil Williams at 2022-05-26T09:00:45+01:00
CVE-2022-26945/golang-github-hashicorp-go-getter unfixed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3483,11 +3483,20 @@ CVE-2022-30325
 CVE-2022-30324
 	RESERVED
 CVE-2022-30323 (HashiCorp go-getter through 2.0.2 does not safely perform downloads (i ...)
-	TODO: check
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+	NOTE: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
+	NOTE: https://github.com/hashicorp/go-getter/pull/359
+	NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
 CVE-2022-30322 (HashiCorp go-getter through 2.0.2 does not safely perform downloads (i ...)
-	TODO: check
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+	NOTE: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
+	NOTE: https://github.com/hashicorp/go-getter/pull/359
+	NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
 CVE-2022-30321 (HashiCorp go-getter through 2.0.2 does not safely perform downloads (i ...)
-	TODO: check
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+	NOTE: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
+	NOTE: https://github.com/hashicorp/go-getter/pull/359
+	NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
 CVE-2022-1616 (Use after free in append_command in GitHub repository vim/vim prior to ...)
 	{DLA-3011-1}
 	- vim <unfixed>
@@ -13320,7 +13329,10 @@ CVE-2022-0936 (Cross-site Scripting (XSS) - Stored in GitHub repository autolab/
 CVE-2022-26946
 	RESERVED
 CVE-2022-26945 (HashiCorp go-getter before 2.0.2 allows Command Injection. ...)
-	TODO: check
+	- golang-github-hashicorp-go-getter <unfixed> (bug #1011741)
+	NOTE: https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
+	NOTE: https://github.com/hashicorp/go-getter/pull/359
+	NOTE: https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45 (v1.6.0)
 CVE-2022-26944
 	RESERVED
 CVE-2022-26943
@@ -28149,7 +28161,7 @@ CVE-2022-0087 (keystone is vulnerable to Improper Neutralization of Input During
 CVE-2021-46130
 	RESERVED
 CVE-2022-22306 (An improper certificate validation vulnerability [CWE-295] in FortiOS  ...)
-	TODO: check
+	NOT-FOR-US: Fortinet FortiOS
 CVE-2022-22305
 	RESERVED
 CVE-2022-22304



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ed7aeadbf782e9e8f117d9f1537e7df74c2b0ff1...b7c8cb5d92acb3cddc61d421b9c238eaad687bdd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ed7aeadbf782e9e8f117d9f1537e7df74c2b0ff1...b7c8cb5d92acb3cddc61d421b9c238eaad687bdd
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220526/88eda581/attachment.htm>