[Git][security-tracker-team/security-tracker][master] 2 commits: Add missing commit for for CVE-2022-25901/node-cookiejar.

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
57ba4142 by Chris Lamb at 2023-09-07T11:08:19-07:00
Add missing commit for for CVE-2022-25901/node-cookiejar.

- - - - -
83aaca26 by Chris Lamb at 2023-09-07T11:09:16-07:00
data/dla-needed.txt: Triage node-cookiejar for buster LTS.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -110907,6 +110907,7 @@ CVE-2022-25901 (Versions of the package cookiejar before 2.1.4 are vulnerable to
 	[buster] - node-cookiejar <postponed> (Minor issue, ReDoS)
 	NOTE: https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
 	NOTE: https://github.com/bmeck/node-cookiejar/pull/39
+	NOTE: https://github.com/bmeck/node-cookiejar/commit/a9a320c3c49d65df491f5721969cfbf9e128d9af
 	NOTE: https://github.com/bmeck/node-cookiejar/commit/eaa00021caf6ae09449dde826108153b578348e5
 CVE-2022-25900 (All versions of package git-clone are vulnerable to Command Injection  ...)
 	NOT-FOR-US: Node git-clone


=====================================
data/dla-needed.txt
=====================================
@@ -129,6 +129,10 @@ nasm
   NOTE: 20230907: Added due to CVE-2020-18780, CVE-2020-21685 & CVE-2020-21686,
   NOTE: 20230907: but some of these may require some investigation. (lamby)
 --
+node-cookiejar
+  NOTE: 20230907: Added by Front-Desk (lamby)
+  NOTE: 20230907: CVE-2022-25901 was ignored & now fixed in bullseye; patch easy to backport. (lamby)
+--
 nova
   NOTE: 20230302: Re-add, request by maintainer (Beuc)
   NOTE: 20230302: zigo says that DLA 3302-1 ships a buster-specific CVE-2022-47951 backport that introduces regression



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/039a69be4117a6509cdc415c80c2ad79ab29ebcd...83aaca268c9d5cda70548973a7303cfcbe530ce2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/039a69be4117a6509cdc415c80c2ad79ab29ebcd...83aaca268c9d5cda70548973a7303cfcbe530ce2
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230907/8bcc66d5/attachment.htm>