[Git][security-tracker-team/security-tracker][master] Track fixed version for curl via unstable

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
da56174b by Salvatore Bonaccorso at 2024-03-27T20:43:07+01:00
Track fixed version for curl via unstable

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -12,7 +12,7 @@ CVE-2024-26652 [net: pds_core: Fix possible double free in error handling path]
 	[buster] - linux <not-affected> (Vulnerable code not present)
 	NOTE: https://git.kernel.org/linus/ba18deddd6d502da71fd6b6143c53042271b82bd (6.8)
 CVE-2024-2004 [Usage of disabled protocol]
-	- curl <unfixed>
+	- curl 8.7.1-1
 	[bookworm] - curl <no-dsa> (Minor issue)
 	[bullseye] - curl <not-affected> (Vulnerable code not present)
 	[buster] - curl <not-affected> (Vulnerable code not present)
@@ -20,20 +20,20 @@ CVE-2024-2004 [Usage of disabled protocol]
 	NOTE: Introduced by: https://github.com/curl/curl/commit/e6f8445edef8e7996d1cfb141d6df184efef972c (curl-7_85_0)
 	NOTE: Fixed by: https://github.com/curl/curl/commit/17d302e56221f5040092db77d4f85086e8a20e0e (curl-8_7_0)
 CVE-2024-2379 [QUIC certificate check bypass with wolfSSL]
-	- curl <unfixed> (unimportant)
+	- curl 8.7.1-1 (unimportant)
 	NOTE: https://curl.se/docs/CVE-2024-2379.html
 	NOTE: Introduced by: https://github.com/curl/curl/commit/5d044ad9480a9f556f4b6a252d7533b1ba7fe57e (curl-8_6_0)
 	NOTE: Fixed by: https://github.com/curl/curl/commit/aedbbdf18e689a5eee8dc39600914f5eda6c409c (curl-8_7_0)
 	NOTE: curl in Debian not built with wolfSSL support
 CVE-2024-2398 [HTTP/2 push headers memory-leak]
-	- curl <unfixed>
+	- curl 8.7.1-1
 	[bookworm] - curl <no-dsa> (Minor issue)
 	[bullseye] - curl <no-dsa> (Minor issue)
 	NOTE: https://curl.se/docs/CVE-2024-2398.html
 	NOTE: Introduced by: https://github.com/curl/curl/commit/ea7134ac874a66107e54ff93657ac565cf2ec4aa (curl-7_44_0)
 	NOTE: Fixed by: https://github.com/curl/curl/commit/deca8039991886a559b67bcd6701db800a5cf764 (curl-8_7_0)
 CVE-2024-2466 [TLS certificate check bypass with mbedTLS]
-	- curl <unfixed> (unimportant)
+	- curl 8.7.1-1 (unimportant)
 	[bookworm] - curl <not-affected> (Vulnerable code not present)
 	[bullseye] - curl <not-affected> (Vulnerable code not present)
 	[buster] - curl <not-affected> (Vulnerable code not present)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/da56174ba2c87bb6e5e778b3a7d8669b2acc5ac3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/da56174ba2c87bb6e5e778b3a7d8669b2acc5ac3
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240327/5bb04a2b/attachment-0001.htm>