[Git][security-tracker-team/security-tracker][master] 6 commits: Triage CVE-2023-46136 in python-werkzeug for buster LTS.

Chris Lamb (@lamby) lamby at debian.org
Sat Nov 4 09:40:31 GMT 2023



Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4fd35094 by Chris Lamb at 2023-11-04T10:37:28+01:00
Triage CVE-2023-46136 in python-werkzeug for buster LTS.

- - - - -
4731c035 by Chris Lamb at 2023-11-04T10:37:52+01:00
Triage CVE-2023-44271 in pillow for buster LTS.

- - - - -
b8fa93ef by Chris Lamb at 2023-11-04T10:38:31+01:00
Triage CVE-2023-42295 & CVE-2023-42299 in openimageio for buster LTS.

- - - - -
ecd6249a by Chris Lamb at 2023-11-04T10:38:47+01:00
Triage CVE-2023-5072 in libjettison-java for buster LTS.

- - - - -
41f0d13b by Chris Lamb at 2023-11-04T10:39:05+01:00
Triage CVE-2023-46303 in calibre for buster LTS.

- - - - -
d82092c7 by Chris Lamb at 2023-11-04T10:39:46+01:00
Triage CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802 in apache2 for buster LTS.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -90,6 +90,7 @@ CVE-2023-44271 (An issue was discovered in Pillow before 10.0.0. It is a Denial
 	- pillow 10.0.0-1
 	[bookworm] - pillow <no-dsa> (Minor issue)
 	[bullseye] - pillow <no-dsa> (Minor issue)
+	[buster] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/7244
 	NOTE: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 (10.0.0)
 CVE-2023-43982 (Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovere ...)
@@ -102,6 +103,7 @@ CVE-2023-42299 (Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 all
 	- openimageio 2.4.13.0+dfsg-1
 	[bookworm] - openimageio <no-dsa> (Minor issue)
 	[bullseye] - openimageio <no-dsa> (Minor issue)
+	[buster] - openimageio <no-dsa> (Minor issue)
 	NOTE: https://github.com/OpenImageIO/oiio/issues/3840
 	NOTE: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/3841
 	NOTE: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/5ff2c56dd28e96f67ed8f80d8a3d1235e51f9957 (v2.4.12.0)
@@ -1722,6 +1724,7 @@ CVE-2023-46136 (Werkzeug is a comprehensive WSGI web application library. If an
 	- python-werkzeug <unfixed> (bug #1054553)
 	[bookworm] - python-werkzeug <no-dsa> (Minor issue)
 	[bullseye] - python-werkzeug <no-dsa> (Minor issue)
+	[buster] - python-werkzeug <no-dsa> (Minor issue)
 	NOTE: https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw
 	NOTE: https://github.com/pallets/werkzeug/commit/b1916c0c083e0be1c9d887ee2f3d696922bfc5c1 (3.0.1)
 CVE-2023-46135 (rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys.  ...)
@@ -2105,6 +2108,7 @@ CVE-2023-42295 (An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker
 	- openimageio 2.4.16.0+dfsg-1 (bug #1054873)
 	[bookworm] - openimageio <no-dsa> (Minor issue)
 	[bullseye] - openimageio <no-dsa> (Minor issue)
+	[buster] - openimageio <no-dsa> (Minor issue)
 	NOTE: https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/3947
 	NOTE: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/3948
 	NOTE: Fixed by: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/15750af31a5d130ea63ac133453eb5448cefa636 (v2.5.3.0-beta1)
@@ -2184,6 +2188,7 @@ CVE-2023-46303 (link_to_local_path in ebooks/conversion/plugins/html_input.py in
 	- calibre 6.19.1-1
 	[bookworm] - calibre <no-dsa> (Minor issue)
 	[bullseye] - calibre <no-dsa> (Minor issue)
+	[buster] - calibre <no-dsa> (Minor issue)
 	NOTE: https://github.com/0x1717/ssrf-via-img
 	NOTE: https://github.com/kovidgoyal/calibre/commit/bbbddd2bf4ef4ddb467b0aeb0abe8765ed7f8a6b (v6.19.0)
 CVE-2021-46898 (views/switch.py in django-grappelli (aka Django Grappelli) before 2.15 ...)
@@ -2705,6 +2710,7 @@ CVE-2023-45802 (When a HTTP/2 stream was reset (RST frame) by a client, there wa
 	- apache2 2.4.58-1
 	[bookworm] - apache2 <no-dsa> (Minor issue)
 	[bullseye] - apache2 <no-dsa> (Minor issue)
+	[buster] - apache2 <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/19/6
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-45802
 	NOTE: https://github.com/icing/blog/blob/main/h2-rapid-reset.md#cve-2023-45802
@@ -2712,6 +2718,7 @@ CVE-2023-43622 (An attacker, opening a HTTP/2 connection with an initial window
 	- apache2 2.4.58-1
 	[bookworm] - apache2 <no-dsa> (Minor issue)
 	[bullseye] - apache2 <no-dsa> (Minor issue)
+	[buster] - apache2 <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/19/5
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-43622
 CVE-2023-5654 (The React Developer Tools extension registers a message listener with  ...)
@@ -3752,6 +3759,7 @@ CVE-2023-5072 (Denial of Service  in JSON-Java versions up to and including 2023
 	- libjettison-java <unfixed> (bug #1053884)
 	[bookworm] - libjettison-java <no-dsa> (Minor issue)
 	[bullseye] - libjettison-java <no-dsa> (Minor issue)
+	[buster] - libjettison-java <no-dsa> (Minor issue)
 	NOTE: https://github.com/stleary/JSON-java/issues/758
 	NOTE: https://github.com/stleary/JSON-java/issues/771
 	NOTE: https://github.com/stleary/JSON-java/pull/772/
@@ -25150,6 +25158,7 @@ CVE-2023-31122 (Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Ser
 	- apache2 2.4.58-1
 	[bookworm] - apache2 <no-dsa> (Minor issue)
 	[bullseye] - apache2 <no-dsa> (Minor issue)
+	[buster] - apache2 <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/19/4
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-31122
 CVE-2023-31121



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b0b39be0a65d0e464978c90f2b02c365cf432260...d82092c750a212050856672eeba624d813a4fb6d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b0b39be0a65d0e464978c90f2b02c365cf432260...d82092c750a212050856672eeba624d813a4fb6d
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20231104/5d5b09d7/attachment.htm>


More information about the debian-security-tracker-commits mailing list