[Git][security-tracker-team/security-tracker][master] Remove consul from dla-needed.txt.

[Abhijith PA (@abhijith)]

Abhijith PA pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eebe9d4c by Abhijith PA at 2023-05-14T15:49:54+05:30
Remove consul from dla-needed.txt.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -85882,6 +85882,7 @@ CVE-2022-29154 (An issue was discovered in rsync before 3.2.5 that allows malici
 	NOTE: https://git.samba.org/?p=rsync.git;a=commit;h=2f7c583143bc6e80902139c23d9d7283f88fbc6a (v3.2.5pre1)
 CVE-2022-29153 (HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11. ...)
 	- consul <unfixed> (bug #1017982)
+	[buster] - consul <ignored> (Intrusive to backport)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
 	NOTE: https://github.com/hashicorp/consul/commit/72e1ce6317d6a4b28c73cd15f3976eb2c362be19 (v1.9.17)
 CVE-2022-29152 (The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an ...)
@@ -136530,6 +136531,7 @@ CVE-2021-37220 (MuPDF through 1.18.1 has an out-of-bounds write because the cach
 	NOTE: On Stretch, an earlier version of the code exits early instead of crashing.
 CVE-2021-37219 (HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows no ...)
 	- consul 1.8.7+dfsg1-6 (bug #1015218)
+	[buster] - consul <ignored> (Minor issue; intrusive to backport)
 	NOTE: https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024
 	NOTE: https://github.com/hashicorp/consul/commit/ccf8eb1947357434eb6e66303ddab79f4c9d4103
 CVE-2021-37218 (HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server  ...)
@@ -197187,7 +197189,7 @@ CVE-2020-25865
 	RESERVED
 CVE-2020-25864 (HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value ( ...)
 	- consul 1.8.7+dfsg1-2 (bug #987351)
-	[buster] - consul <no-dsa> (Minor issue)
+	[buster] - consul <ignored> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1950275
 	NOTE: https://github.com/hashicorp/consul/pull/10023
 CVE-2020-25863 (In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the ...)
@@ -243630,7 +243632,7 @@ CVE-2020-7220 (HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain
 	NOT-FOR-US: HashiCorp Vault
 CVE-2020-7219 (HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services a ...)
 	- consul 1.7.0+dfsg1-1 (bug #950736)
-	[buster] - consul <no-dsa> (Minor issue)
+	[buster] - consul <ignored> (Minor issue, intrusive to backport)
 	NOTE: https://github.com/hashicorp/consul/issues/7159
 	NOTE: Fixed in 1.6.3.
 CVE-2020-7218 (HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services al ...)
@@ -316114,7 +316116,7 @@ CVE-2018-19654 (An issue was discovered in Sales & Company Management System (SC
 	NOT-FOR-US: Sales & Company Management System (SCMS)
 CVE-2018-19653 (HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent  ...)
 	- consul 1.4.4~dfsg1-1
-	[buster] - consul <no-dsa> (Minor issue)
+	[buster] - consul <ignored> (Minor issue)
 	NOTE: https://github.com/hashicorp/consul/pull/5069
 CVE-2018-19652
 	RESERVED


=====================================
data/dla-needed.txt
=====================================
@@ -17,13 +17,6 @@ cairosvg
   NOTE: 20230323: Programming language: Python.
   NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport the --unsafe switch, introduced in 1.0.21, might work (dleidert)
 --
-consul
-  NOTE: 20221031: Programming language: Go.
-  NOTE: 20221031: Concluded that the package should be fixed by the CVE description. Source code not analyzed in detail.
-  NOTE: 20230206: VCS: https://salsa.debian.org/lts-team/packages/consul.git
-  NOTE: 20230423: WIP, Fixed CVE-2018-19653 (abhijith)
-  NOTE: 20230422: Resume work. (abhijith)
---
 docker.io
   NOTE: 20230303: Programming language: Go.
   NOTE: 20230303: Follow fixes from bullseye 11.2 (Beuc/front-desk)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eebe9d4c5e1c30f2c75ff33e5abae4161b83d46d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eebe9d4c5e1c30f2c75ff33e5abae4161b83d46d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230514/5e04c897/attachment.htm>