[Git][security-tracker-team/security-tracker][master] CVE-2022-23134 is not affecting buster and bullseye:

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
df0a35de by Tobias Frost at 2023-04-09T18:20:53+02:00
CVE-2022-23134 is not affecting buster and bullseye:

Upstream comment [1] in upstream ticket ZBX-20384:

  4.0 and 5.0 branches were excluded because those were not affected by the
  issue (the session data was not stored in cookies and therefore was not exposed
  to users).

[1] https://support.zabbix.com/browse/ZBX-20384?focusedCommentId=648239&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-648239

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -100442,9 +100442,11 @@ CVE-2022-23135 (There is a directory traversal vulnerability in some home gatewa
 CVE-2022-23134 (After the initial setup process, some steps of setup.php file are reac ...)
 	{DLA-2914-1}
 	- zabbix 1:6.0.7+dfsg-2
-	[bullseye] - zabbix <no-dsa> (Minor issue)
+	[bullseye] - zabbix <not-affected> (See NOTE below)
+	[buster] - zabbix <not-affected> (See NOTE below)
 	NOTE: https://support.zabbix.com/browse/ZBX-20384
 	NOTE: https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/aa0fecfbcc9794bc00206630a7424575dfc944df (5.0.19rc2)
+	NOTE: 4.0 and 5.0 are not affected: https://support.zabbix.com/browse/ZBX-20384?focusedCommentId=648239&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-648239
 CVE-2022-23133 (An authenticated user can create a hosts group from the configuration  ...)
 	- zabbix 1:6.0.7+dfsg-2
 	[bullseye] - zabbix <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/df0a35de687cca25a25549c8be2a9745dd9607b1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/df0a35de687cca25a25549c8be2a9745dd9607b1
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230409/933332eb/attachment.htm>