[Git][security-tracker-team/security-tracker][master] Reserve DLA-3386-1 for grunt

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a71638a8 by Chris Lamb at 2023-04-06T10:42:40+01:00
Reserve DLA-3386-1 for grunt

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -93718,7 +93718,6 @@ CVE-2022-0436 (Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
 	[experimental] - grunt 1.5.2-1
 	- grunt 1.5.2-2 (bug #1009676)
 	[bullseye] - grunt 1.3.0-1+deb11u1
-	[buster] - grunt <no-dsa> (Minor issue)
 	[stretch] - grunt <no-dsa> (Minor issue)
 	NOTE: https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665 (v1.5.0)
 	NOTE: https://github.com/gruntjs/grunt/pull/1740


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[06 Apr 2023] DLA-3386-1 grunt - security update
+	{CVE-2022-0436}
+	[buster] - grunt 1.0.1-8+deb10u3
 [05 Apr 2023] DLA-3385-1 trafficserver - security update
 	{CVE-2022-31778 CVE-2022-31779 CVE-2022-32749 CVE-2022-37392}
 	[buster] - trafficserver 8.1.6+ds-1~deb10u1


=====================================
data/dla-needed.txt
=====================================
@@ -102,11 +102,6 @@ golang-yaml.v2
   NOTE: 20230125: VCS: https://salsa.debian.org/lts-team/packages/golang-yaml.v2.git
   NOTE: 20230125: Special attention: limited support; requires rebuilding reverse build dependencies (though recent bullseye updates didn't).
 --
-grunt (Chris Lamb)
-  NOTE: 20230404: Programming language: JavaScript.
-  NOTE: 20230404: CVE-2022-0436 fixed in all other dists (Debian 11.4, ELA-672-1 for stretch) (Beuc/front-desk)
-  NOTE: 20230405: Re-added since today's DLA didn't fix the above CVE, please apply a fix or clarify the tracker (Beuc/front-desk)
---
 hdf5
   NOTE: 20230318: Programming language: C.
   NOTE: 20230318: VCS: https://salsa.debian.org/lts-team/packages/hdf5.git



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a71638a8ea7b592a5d268a7b7b81b8e9795c4db0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a71638a8ea7b592a5d268a7b7b81b8e9795c4db0
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230406/b8380e52/attachment.htm>