[Git][security-tracker-team/security-tracker][master] Reserve DLA-4003-1 for node-postcss

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
871084c9 by Bastien Roucariès at 2024-12-26T22:18:03+00:00
Reserve DLA-4003-1 for node-postcss

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -4353,7 +4353,6 @@ CVE-2024-55566 (ColPack 1.0.10 through 9a7293a has a predictable temporary file
 CVE-2024-55565 (nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 ...)
 	- node-postcss 8.4.49+~cs9.2.32-1
 	[bookworm] - node-postcss <no-dsa> (Minor issue)
-	[bullseye] - node-postcss <postponed> (Minor issue; can be fixed in next update)
 	NOTE: node-postcss bundles nanoid
 	NOTE: https://github.com/ai/nanoid/pull/510
 	NOTE: https://github.com/ai/nanoid/commit/d643045f40d6dc8afa000a644d857da1436ed08c (3.3.8)
@@ -114504,7 +114503,6 @@ CVE-2023-5201 (The OpenHook plugin for WordPress is vulnerable to Remote Code Ex
 CVE-2023-44270 (An issue was discovered in PostCSS before 8.4.31. The vulnerability af ...)
 	- node-postcss 8.4.31+~cs8.0.26-1 (bug #1053282)
 	[bookworm] - node-postcss <no-dsa> (Minor issue)
-	[bullseye] - node-postcss <no-dsa> (Minor issue)
 	[buster] - node-postcss <postponed> (Minor issue)
 	NOTE: https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5 (8.4.31)
 CVE-2023-43711 (Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) v ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[26 Dec 2024] DLA-4003-1 node-postcss - security update
+	{CVE-2021-23566 CVE-2023-44270 CVE-2024-55565}
+	[bullseye] - node-postcss 8.2.1+~cs5.3.23-8+deb11u1
 [23 Dec 2024] DLA-4002-1 intel-microcode - security update
 	{CVE-2024-23918 CVE-2024-21853 CVE-2024-21820}
 	[bullseye] - intel-microcode 3.20241112.1~deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -126,9 +126,6 @@ mosquitto (abhijith)
   NOTE: 20241126: Backported https://people.debian.org/~abhijith/upload/gss/CVE-2024-3935.patch (abhijith)
   NOTE: 20241217: Backporting CVE-2024-8376 (abhijith)
 --
-node-postcss (rouca)
-  NOTE: 20241214: Added by Front-Desk (lamby)
---
 nvidia-cuda-toolkit
   NOTE: 20241004: Added by Front-Desk (Beuc)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/871084c9339c9882a9a022064bdc60116f153efb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/871084c9339c9882a9a022064bdc60116f153efb
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241226/0021544e/attachment.htm>