[Git][security-tracker-team/security-tracker][master] Reserve DLA-3289-1 for dojo

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2b181cd3 by Guilhem Moulin at 2023-01-28T22:57:33+01:00
Reserve DLA-3289-1 for dojo

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -149209,7 +149209,6 @@ CVE-2021-23451 (The package otp-generator before 3.0.0 are vulnerable to Insecur
 CVE-2021-23450 (All versions of package dojo are vulnerable to Prototype Pollution via ...)
 	- dojo 1.17.2+dfsg1-1 (bug #1014785)
 	[bullseye] - dojo 1.15.4+dfsg1-1+deb11u1
-	[buster] - dojo <no-dsa> (Minor issue)
 	NOTE: https://github.com/advisories/GHSA-m8gw-hjpr-rjv7
 	NOTE: Fixed by: https://github.com/dojo/dojo/commit/b7b8b279f3e082e9d4b54144fe831bdc77b2e0c9
 CVE-2021-23449 (This affects the package vm2 before 3.9.4 via a Prototype Pollution at ...)
@@ -229633,7 +229632,6 @@ CVE-2020-4052 (In Wiki.js before 2.4.107, there is a stored cross-site scripting
 	NOT-FOR-US: Wiki.js
 CVE-2020-4051 (In Dijit before versions 1.11.11, and greater than or equal to 1.12.0  ...)
 	- dojo 1.15.4+dfsg1-1 (bug #970000)
-	[buster] - dojo <no-dsa> (Minor issue)
 	NOTE: https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6
 	NOTE: https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301
 CVE-2020-4045 (SSB-DB version 20.0.0 has an information disclosure vulnerability. The ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[28 Jan 2023] DLA-3289-1 dojo - security update
+	{CVE-2020-4051 CVE-2021-23450}
+	[buster] - dojo 1.14.2+dfsg1-1+deb10u3
 [28 Jan 2023] DLA-3288-1 curl - security update
 	{CVE-2022-27774 CVE-2022-32221 CVE-2022-35252 CVE-2022-43552}
 	[buster] - curl 7.64.0-4+deb10u4


=====================================
data/dla-needed.txt
=====================================
@@ -44,10 +44,6 @@ consul
   NOTE: 20221031: Programming language: Go.
   NOTE: 20221031: Concluded that the package should be fixed by the CVE description. Source code not analyzed in detail.
 --
-dojo (guilhem)
-  NOTE: 20230105: Programming language: JavaScript.
-  NOTE: 20230105: Follow fixes from bullseye 11.6 (Beuc/front-desk)
---
 erlang
   NOTE: 20221119: Programming language: Erlang.
   NOTE: 20221119: at least CVE-2022-37026 needs to be fixed (original request has been for Stretch)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b181cd333ea02a39a88d902391d99028c9c2790

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b181cd333ea02a39a88d902391d99028c9c2790
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230128/421abe88/attachment.htm>