[Git][security-tracker-team/security-tracker][master] Clarify status for CVE-2016-10127

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
db6b816a by Salvatore Bonaccorso at 2023-02-28T21:37:36+01:00
Clarify status for CVE-2016-10127

Note that back then the scope of the CVE was redefined. The commit added
is covered by CVE-2016-10149 and CVE-2016-10127 remained open. The scope
is broader and a fix would need to be implemented in libxml2.

Still back then there was confusion between scopes of CVE-2016-10127 and
CVE-2016-10149 so let's move it to negligible impact for the remaining
issue.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -397284,14 +397284,11 @@ CVE-2016-10126 (Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x befor
 CVE-2016-10125 (D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded  ...)
 	NOT-FOR-US: D-Link
 CVE-2016-10127 (PySAML2 allows remote attackers to conduct XML external entity (XXE) a ...)
-	- python-pysaml2 4.5.0-2 (low; bug #859135)
-	[stretch] - python-pysaml2 <no-dsa> (Minor issue)
-	[jessie] - python-pysaml2 <no-dsa> (Minor issue)
+	- python-pysaml2 <unfixed> (unimportant; bug #859135)
 	NOTE: https://github.com/rohe/pysaml2/issues/366
 	NOTE: A proper fix for this issue would be to fix the underlying issue in src:libxml2
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1411794#c12
 	NOTE: https://www.openwall.com/lists/oss-security/2017/01/19/5 (for the scope of the CVE)
-	NOTE: https://github.com/IdentityPython/pysaml2/commit/6e09a25d9 (4.4.0-1)
 CVE-2016-10149 (XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier a ...)
 	{DSA-3759-1}
 	- python-pysaml2 3.0.0-5 (bug #850716)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/db6b816a5a70e0f4d813eb406665b5ff1c8b5263

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/db6b816a5a70e0f4d813eb406665b5ff1c8b5263
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230228/98b1a49d/attachment.htm>