[Git][security-tracker-team/security-tracker][master] 3 commits: CVE-2023-27585,asterisk: Buster is affected

[Markus Koschany (@apo)]

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ec479a33 by Markus Koschany at 2023-04-18T22:40:56+02:00
CVE-2023-27585,asterisk: Buster is affected

The vulnerable code is shipped in debian/pjproject_2.12.1~dfsg.orig.tar.bz2 and
applied at build time. In the past the pjproject library has been packaged
separately. Debian's maintainer chose to embed it later.

- - - - -
1b52d3ba by Markus Koschany at 2023-04-18T22:40:56+02:00
LTS: add asterisk to dla-needed.txt

- - - - -
480c118b by Markus Koschany at 2023-04-18T22:40:56+02:00
Claim asterisk in dla-needed.txt

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -9774,7 +9774,6 @@ CVE-2023-27586 (CairoSVG is an SVG converter based on Cairo, a 2D graphics libra
 	NOTE: Introduced in https://github.com/Kozea/CairoSVG/commit/1ee0889f4015ebaddcf9976d43222e673155797c (0.3)
 CVE-2023-27585 (PJSIP is a free and open source multimedia communication library writt ...)
 	- asterisk <unfixed>
-	[buster] - asterisk <not-affected> (Vulnerable code not present)
 	- pjproject <removed>
 	- ring <unfixed>
 	NOTE: https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr


=====================================
data/dla-needed.txt
=====================================
@@ -26,6 +26,11 @@ apache2
   NOTE: 20230312: Special attention: Double check an update! Package is used by many customers and users!.
   NOTE: 20230326: VCS: https://salsa.debian.org/apache-team/apache2. Yadd is ok for using apache2 salsa tree
 --
+asterisk (Markus Koschany)
+  NOTE: 20230418: Programming language: C.
+  NOTE: 20230418: VCS: https://salsa.debian.org/lts-team/packages/asterisk.git
+  NOTE: 20230418: Special attention: pjproject library is included in debian directory!.
+--
 cairosvg (dleidert)
   NOTE: 20230323: Programming language: Python.
   NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport the --unsafe switch, introduced in 1.0.21, might work (dleidert)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e743fb4f13168814042a19075075d58420abd969...480c118bf4008af50f77dbd50d34049b2c843df0
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230418/022dff31/attachment-0001.htm>