[Git][security-tracker-team/security-tracker][master] Tidy golang* buster triage

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6e32da8c by Sylvain Beucler at 2024-03-14T12:34:47+01:00
Tidy golang* buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -17035,7 +17035,7 @@ CVE-2023-50658 (The jose2go component before 1.6.0 for Go allows attackers to ca
 	- golang-github-dvsekhvalnov-jose2go <unfixed> (bug #1059507)
 	[bookworm] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
 	[bullseye] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
-	[buster] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
+	[buster] - golang-github-dvsekhvalnov-jose2go <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
 	NOTE: https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 (v1.6.0)
 CVE-2023-50339 (Stored cross-site scripting vulnerability exists in the User Managemen ...)
 	NOT-FOR-US: GROWI
@@ -18553,7 +18553,7 @@ CVE-2023-48795 (The SSH transport protocol with certain OpenSSH extensions, foun
 	- golang-go.crypto 1:0.17.0-1 (bug #1059003)
 	[bookworm] - golang-go.crypto <no-dsa> (Minor issue)
 	[bullseye] - golang-go.crypto <no-dsa> (Minor issue)
-	[buster] - golang-go.crypto <no-dsa> (Minor issue)
+	[buster] - golang-go.crypto <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
 	- jsch <not-affected> (ChaCha20-Poly1305 support introduced in 0.1.61; *-EtM support introduced in 0.1.58)
 	- libssh 0.10.6-1 (bug #1059004)
 	- libssh2 1.11.0-4 (bug #1059005)
@@ -56964,7 +56964,7 @@ CVE-2023-29408 (The TIFF decoder does not place a limit on the size of compresse
 	- golang-golang-x-image 0.11.0-1 (bug #1043159)
 	[bookworm] - golang-golang-x-image <no-dsa> (Minor issue)
 	[bullseye] - golang-golang-x-image <no-dsa> (Minor issue)
-	[buster] - golang-golang-x-image <no-dsa> (Limited support, minor issue, DoS)
+	[buster] - golang-golang-x-image <postponed> (Limited support, minor issue, DoS)
 	NOTE: https://go.dev/issue/61582
 	NOTE: https://go.dev/cl/514897
 	NOTE: https://github.com/golang/image/commit/cb227cd2c919b27c6206fe0c1041a8bcc677949d (v0.10.0)
@@ -67304,7 +67304,7 @@ CVE-2023-26125 (Versions of the package github.com/gin-gonic/gin before 1.9.0 ar
 	- golang-github-gin-gonic-gin <unfixed> (bug #1035498)
 	[bookworm] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
 	[bullseye] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
-	[buster] - golang-github-gin-gonic-gin <no-dsa> (Minor issue)
+	[buster] - golang-github-gin-gonic-gin <postponed> (Limited support, minor issue, follow bullseye DSAs/point-releases)
 	NOTE: https://github.com/gin-gonic/gin/pull/3500
 	NOTE: https://github.com/gin-gonic/gin/pull/3503
 	NOTE: https://github.com/gin-gonic/gin/commit/81ac7d55a09e34013225db0aeac6e70c1ae68928 (v1.9.0)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e32da8cc8402aa58089df0e41fad6ee94eed5d4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e32da8cc8402aa58089df0e41fad6ee94eed5d4
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240314/d259bf2a/attachment-0001.htm>