[Git][security-tracker-team/security-tracker][master] Reserve DLA-3538-1 for zabbix

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ef3a2751 by Tobias Frost at 2023-08-22T15:20:30+02:00
Reserve DLA-3538-1 for zabbix

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -58556,7 +58556,6 @@ CVE-2022-43516 (A Firewall Rule which allows all incoming TCP connections to all
 CVE-2022-43515 (Zabbix Frontend provides a feature that allows admins to maintain the  ...)
 	- zabbix 1:6.0.13+dfsg-1 (bug #1026847)
 	[bullseye] - zabbix <ignored> (Minor issue)
-	[buster] - zabbix <ignored> (Minor issue)
 	NOTE: https://support.zabbix.com/browse/ZBX-22050
 	NOTE: Fixed by: https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/aa58889ba54b2350e211a5f315baabbaf7228045 (4.0.45rc1)
 	NOTE: Fixed by: https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/50668e9d64af32cdc67a45082c556699ff86565e (5.0.30rc1)
@@ -272022,7 +272021,6 @@ CVE-2019-19395
 	RESERVED
 CVE-2013-7484 (Zabbix before 5.0 represents passwords in the users table with unsalte ...)
 	- zabbix 1:5.0.0+dfsg-1
-	[buster] - zabbix <no-dsa> (Minor issue)
 	[stretch] - zabbix <no-dsa> (Minor issue)
 	[jessie] - zabbix <no-dsa> (Minor issue)
 	NOTE: https://support.zabbix.com/browse/ZBX-16551
@@ -281206,7 +281204,6 @@ CVE-2019-17383 (The netaddr gem before 2.0.4 for Ruby has misconfigured file per
 	- ruby-netaddr <not-affected> (Upstream packaging issue)
 CVE-2019-17382 (An issue was discovered in zabbix.php?action=dashboard.view&dashboardi ...)
 	- zabbix 1:5.0.0+dfsg-1
-	[buster] - zabbix <no-dsa> (Minor issue, no patch, guest accounts can be disabled)
 	[stretch] - zabbix <ignored> (Minor issue, no patch, guest accounts can be disabled)
 	[jessie] - zabbix <no-dsa> (Minor issue, guest accounts can be disabled)
 	NOTE: https://support.zabbix.com/browse/ZBX-16789


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[22 Aug 2023] DLA-3538-1 zabbix - security update
+	{CVE-2013-7484 CVE-2019-17382 CVE-2022-35229 CVE-2022-43515 CVE-2023-29450 CVE-2023-29451 CVE-2023-29454 CVE-2023-29455 CVE-2023-29456 CVE-2023-29457}
+	[buster] - zabbix 1:4.0.4+dfsg-1+deb10u2
 [22 Aug 2023] DLA-3537-1 intel-microcode - security update
 	{CVE-2022-40982 CVE-2022-41804 CVE-2023-23908}
 	[buster] - intel-microcode 3.20230808.1~deb10u1


=====================================
data/dla-needed.txt
=====================================
@@ -230,7 +230,3 @@ w3m (Sylvain Beucler)
   NOTE: 20230812: Follow fixes from bullseye 11.7 (1 CVE) (Beuc/front-desk)
   NOTE: 20230819: No ASAN errors with the PoCs, but the backported fixes do bring some (!), more testing needed. (Beuc)
 --
-zabbix (tobi)
-  NOTE: 20230731: Added by Front-Desk (apo)
-  NOTE: 20230812: WIP, patches backported but largerly untested. Will continue after VAC. (tobi)
---



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef3a2751215bea0070824c5f96a3630a465170ff

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef3a2751215bea0070824c5f96a3630a465170ff
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230822/83adf5b9/attachment-0001.htm>