[Git][security-tracker-team/security-tracker][master] Reserve DLA-3122-1 for dovecot

[Anton Gladky (@gladk)]

Anton Gladky pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a7c7cb8f by Anton Gladky at 2022-09-27T06:08:00+02:00
Reserve DLA-3122-1 for dovecot

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -29107,7 +29107,6 @@ CVE-2022-30551 (OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to
 CVE-2022-30550 (An issue was discovered in the auth component in Dovecot 2.2 and 2.3 b ...)
 	- dovecot 1:2.3.19.1+dfsg1-2 (bug #1016351)
 	[bullseye] - dovecot 1:2.3.13+dfsg1-2+deb11u1
-	[buster] - dovecot <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2022/07/06/9
 	NOTE: https://github.com/dovecot/core/commit/7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904
 	NOTE: https://github.com/dovecot/core/commit/a1022072e2ce36f853873d910287f466165b184b
@@ -92518,7 +92517,6 @@ CVE-2021-33516 (An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.
 	NOTE: https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118659b589afac (master)
 CVE-2021-33515 (The submission service in Dovecot before 2.3.15 allows STARTTLS comman ...)
 	- dovecot 1:2.3.13+dfsg1-2 (bug #990566)
-	[buster] - dovecot <postponed> (Minor issue, fix along with next update)
 	[stretch] - dovecot <not-affected> (Vulnerable code (smtp_server_command queue) introduced later)
 	NOTE: https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html
 	NOTE: https://www.openwall.com/lists/oss-security/2021/06/28/2


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[27 Sep 2022] DLA-3122-1 dovecot - security update
+	{CVE-2021-33515 CVE-2022-30550}
+	[buster] - dovecot 1:2.3.4.1-5+deb10u7
 [26 Sep 2022] DLA-3121-1 firefox-esr - security update
 	{CVE-2022-40956 CVE-2022-40957 CVE-2022-40958 CVE-2022-40959 CVE-2022-40960 CVE-2022-40962}
 	[buster] - firefox-esr 102.3.0esr-1~deb10u2


=====================================
data/dla-needed.txt
=====================================
@@ -30,11 +30,6 @@ curl
   NOTE: 20220904: VCS: https://salsa.debian.org/lts-team/packages/curl.git
   NOTE: 20220904: Special attention: high popcon!.
 --
-dovecot (Anton)
-  NOTE: 20220913: Programming language: C.
-  NOTE: 20220913: VCS: https://salsa.debian.org/lts-team/packages/dovecot.git
-  NOTE: 20220913: Harmonize with bullseye: 1 CVE fixed in Debian 11.5 + 2 other postponed CVEs (Beuc/front-desk)
---
 exiv2
   NOTE: 20220819: Programming language: C++.
   NOTE: 20220819: https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3#diff-bd28aafd4c87975a3a236af74c2200db447587fa0bb4f43ba9beb98738c77b2aL292 does not directly apply, but a very quick glance suggests the earlier code may be equally vulnerable. (Chris Lamb)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7c7cb8f7e52ce9961dd40e9c18573e80a2a519d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7c7cb8f7e52ce9961dd40e9c18573e80a2a519d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220927/eb3b078d/attachment-0001.htm>