[Git][security-tracker-team/security-tracker][master] Mark samba's CVE-2023-0614 and CVE-2022-38023 as ignored. Add note about CVE-2022-42898

[Santiago R.R. (@santiago)]

Santiago R.R. pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7d7a215d by Santiago Ruano Rincón at 2024-03-22T11:23:58-03:00
Mark samba's CVE-2023-0614 and CVE-2022-38023 as ignored. Add note about CVE-2022-42898

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -73235,6 +73235,8 @@ CVE-2023-0615 (A memory leak flaw and potential divide by zero and Integer overf
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2166287
 CVE-2023-0614 (The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confident ...)
 	- samba 2:4.17.7+dfsg-1
+	[bullseye] - samba <ignored> (Domain controller functionality is EOLed, see DSA DSA-5477-1)
+	[buster] - samba <ignored> (Domain controller functionality is EOLed, see DSA-5015-1)
 	NOTE: https://www.samba.org/samba/security/CVE-2023-0614.html
 CVE-2023-0613 (A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and cla ...)
 	NOT-FOR-US: TRENDnet
@@ -101925,6 +101927,7 @@ CVE-2022-42898 (PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.
 	- samba 2:4.17.3+dfsg-1
 	NOTE: https://www.samba.org/samba/security/CVE-2022-42898.html
 	NOTE: https://bugzilla.samba.org/show_bug.cgi?id=15203
+	NOTE: samba: only exploitable in 32-bit systems, according to upstream advisory
 	NOTE: MIT-krb5: https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583 (master)
 	NOTE: MIT-krb5: https://github.com/krb5/krb5/commit/b99de751dd35360c0fccac74a40f4a60dbf1ceea (krb5-1.20.1-final)
 	NOTE: MIT-krb5: https://github.com/krb5/krb5/commit/4e661f0085ec5f969c76c0896a34322c6c432de4 (krb5-1.19.4-final)
@@ -115321,6 +115324,8 @@ CVE-2022-38024
 	RESERVED
 CVE-2022-38023 (Netlogon RPC Elevation of Privilege Vulnerability)
 	- samba 2:4.17.4+dfsg-1
+	[bullseye] - samba <ignored> (Domain controller functionality is EOLed, see DSA DSA-5477-1)
+	[buster] - samba <ignored> (Domain controller functionality is EOLed, see DSA-5015-1)
 	NOTE: https://www.samba.org/samba/security/CVE-2022-38023.html
 	NOTE: possible samba 4.13,4.15 regression: https://bugzilla.samba.org/show_bug.cgi?id=15243
 	NOTE: and https://bugs.launchpad.net/ubuntu/+source/samba/+bug/2003867



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7d7a215d0862978966af171aea64b5823b540a9f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7d7a215d0862978966af171aea64b5823b540a9f
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240322/3069b720/attachment.htm>