[Git][security-tracker-team/security-tracker][master] CVE-2024-3572,CVE-2024-3574/python-scrapy: buster postponed

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6ba50baa by Sylvain Beucler at 2024-05-03T17:43:06+02:00
CVE-2024-3572,CVE-2024-3574/python-scrapy: buster postponed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4966,6 +4966,7 @@ CVE-2024-3574 (In scrapy version 2.10.1, an issue was identified where the Autho
 	- python-scrapy 2.11.1-1
 	[bookworm] - python-scrapy <no-dsa> (Minor issue)
 	[bullseye] - python-scrapy <no-dsa> (Minor issue)
+	[buster] - python-scrapy <postponed> (Minor issue, HTTP-redirect leak)
 	NOTE: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
 	NOTE: https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9
 	NOTE: https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75 (2.11.1)
@@ -4975,6 +4976,7 @@ CVE-2024-3572 (The scrapy/scrapy project is vulnerable to XML External Entity (X
 	- python-scrapy 2.11.1-1
 	[bookworm] - python-scrapy <no-dsa> (Minor issue)
 	[bullseye] - python-scrapy <no-dsa> (Minor issue)
+	[buster] - python-scrapy <postponed> (Minor issue, XXE)
 	NOTE: https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
 	NOTE: https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f (2.11.1)
 	NOTE: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ba50baadf678561d09c37ef9dfa3a561bbafc52

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ba50baadf678561d09c37ef9dfa3a561bbafc52
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240503/aeeafb3e/attachment.htm>