[Git][security-tracker-team/security-tracker][master] Update status for CVE-2024-28757/expat

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
57b51cd4 by Salvatore Bonaccorso at 2024-04-06T17:30:26+02:00
Update status for CVE-2024-28757/expat

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -7858,11 +7858,13 @@ CVE-2024-2351 (A vulnerability classified as critical was found in CodeAstro Eco
 CVE-2024-27698
 	REJECTED
 CVE-2024-28757 (libexpat through 2.6.1 allows an XML Entity Expansion attack when ther ...)
-	- expat 2.6.1-2 (bug #1065868)
+	- expat 2.6.1-2 (bug #1065868; unimportant)
 	NOTE: https://github.com/libexpat/libexpat/pull/842
 	NOTE: https://github.com/libexpat/libexpat/issues/839
 	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/1d50b80cf31de87750103656f6eb693746854aa8
 	NOTE: Tests: https://github.com/libexpat/libexpat/commit/072eca0b72373da103ce15f8f62d1d7b52695454
+	NOTE: Expat provides API to mitigate expansion attacks, ultimately under control of the app using Expat
+	NOTE: Cf. Billion laughs attack assessment for src:expat in CVE-2013-0340.
 CVE-2024-2333 (A vulnerability classified as critical has been found in CodeAstro Mem ...)
 	NOT-FOR-US: CodeAstro Membership Management System
 CVE-2024-2332 (A vulnerability was found in SourceCodester Online Mobile Management S ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57b51cd4ddb8bbc79f27f417783c58cb8c897f5f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57b51cd4ddb8bbc79f27f417783c58cb8c897f5f
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240406/af42dad6/attachment.htm>