[Git][security-tracker-team/security-tracker][master] new node-semver issue

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7fb13fbb by Moritz Muehlenhoff at 2023-07-10T12:35:23+02:00
new node-semver issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -101617,7 +101617,12 @@ CVE-2022-25885 (The package muhammara before 2.6.0; all versions of package humm
 CVE-2022-25884
 	RESERVED
 CVE-2022-25883 (Versions of the package semver before 7.5.2 are vulnerable to Regular  ...)
-	TODO: check
+	- node-semver <unfixed>
+	[bookworm] - node-semver <no-dsa> (Minor issue)
+	[bullseye] - node-semver <no-dsa> (Minor issue)
+	NOTE: https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
+	NOTE: https://github.com/npm/node-semver/pull/564
+	NOTE: https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
 CVE-2022-25882 (Versions of the package onnx before 1.13.0 are vulnerable to Directory ...)
 	NOT-FOR-US: onnx
 CVE-2022-25881 (This affects versions of the package http-cache-semantics before 4.1.1 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fb13fbbb13125e17b28c68135de55646561e681

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fb13fbbb13125e17b28c68135de55646561e681
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230710/3f93e4fc/attachment-0001.htm>