[Git][security-tracker-team/security-tracker][master] 2 commits: node-ejs: follow stable triage, buster postponed

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0f3180c9 by Sylvain Beucler at 2024-05-04T18:05:59+02:00
node-ejs: follow stable triage, buster postponed

- - - - -
b1dd32d8 by Sylvain Beucler at 2024-05-04T18:10:48+02:00
CVE-2024-3572/python-scrapy: buster postponed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3543,6 +3543,7 @@ CVE-2024-33883 (The ejs (aka Embedded JavaScript templates) package before 3.1.1
 	- node-ejs 3.1.10+~3.1.5-1
 	[bookworm] - node-ejs <no-dsa> (Minor issue)
 	[bullseye] - node-ejs <no-dsa> (Minor issue)
+	[buster] - node-ejs <postponed> (Minor issue, follow bullseye)
 	NOTE: https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5 (v3.1.10)
 CVE-2024-33851 (phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based t ...)
 	NOT-FOR-US: phpecc
@@ -7036,6 +7037,7 @@ CVE-2024-3572 (The scrapy/scrapy project is vulnerable to XML External Entity (X
 	- python-scrapy 2.11.1-1
 	[bookworm] - python-scrapy <no-dsa> (Minor issue)
 	[bullseye] - python-scrapy <no-dsa> (Minor issue)
+	[buster] - python-scrapy <postponed> (Minor issue, DoS)
 	NOTE: https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb
 	NOTE: https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f (2.11.1)
 	NOTE: The CVE and bounty descriptions discuss general XML issues (not specifically XXE), but



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5c3f6593ac7705285bafd1e310639110f8b285a4...b1dd32d80f246b98c16b38ee19ae996c40eed42e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5c3f6593ac7705285bafd1e310639110f8b285a4...b1dd32d80f246b98c16b38ee19ae996c40eed42e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240504/8a392333/attachment-0001.htm>