[Git][security-tracker-team/security-tracker][master] 2 commits: Triage CVE-2024-45337 in golang-go.crypto for bullseye LTS.

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
37828eb8 by Chris Lamb at 2024-12-13T11:55:59+00:00
Triage CVE-2024-45337 in golang-go.crypto for bullseye LTS.

- - - - -
197a081a by Chris Lamb at 2024-12-13T11:58:03+00:00
data/dla-needed.txt: Triage gst-plugins-base1.0 for bullseye LTS (CVE-2024-47538, CVE-2024-47541, CVE-2024-47600, CVE-2024-47607, CVE-2024-47615 & CVE-2024-47835)

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -750,6 +750,7 @@ CVE-2024-47537 (GStreamer is a library for constructing graphs of media-handling
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060 (1.24.10)
 CVE-2024-45337 (Applications and libraries which misuse the ServerConfig.PublicKeyCall ...)
 	- golang-go.crypto <unfixed> (bug #1089754)
+	[bullseye] - golang-go.crypto <postponed> (Limited support, minor issue, follow bookworm DSAs/point-releases)
 	NOTE: https://github.com/golang/go/issues/70779
 	NOTE: https://go-review.googlesource.com/c/crypto/+/635315/
 	NOTE: Fixed by: https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 (v0.31.0)


=====================================
data/dla-needed.txt
=====================================
@@ -97,6 +97,15 @@ glewlwyd (Thorsten Alteholz)
   NOTE: 20240815: pu scheduled https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1007884
   NOTE: 20241201: testing package
 --
+gst-plugins-base1.0
+  NOTE: 20241213: Added by Front-Desk (lamby)
+  NOTE: 20241213: CVE-2024-47538, CVE-2024-47541, CVE-2024-47600, CVE-2024-47607, etc. (lamby)
+  NOTE: 20241213: See also gst-plugins-good1.0 (lamby)
+--
+gst-plugins-good1.0
+  NOTE: 20241213: Added by Front-Desk (lamby)
+  NOTE: 20241213: See also gst-plugins-base1.0 (lamby)
+--
 gunicorn
   NOTE: 20241206: Added by coordinator (roberto)
   NOTE: 20241206: CVE-2024-1135 was fixed in buster, is still open (no-dsa) in bullseye and bookworm



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c823a5a4c4b06826de23fc444514687e29d38818...197a081a525b0a420a416ab30010d56cea9d15df

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c823a5a4c4b06826de23fc444514687e29d38818...197a081a525b0a420a416ab30010d56cea9d15df
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241213/ffb2d55b/attachment-0001.htm>