[Git][security-tracker-team/security-tracker][master] Reserve DLA-3818-1 for apache2

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
10b3814a by Bastien Roucariès at 2024-05-24T22:54:17+00:00
Reserve DLA-3818-1 for apache2

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -55878,7 +55878,6 @@ CVE-2020-36698 (The Security & Malware scan by CleanTalk plugin for WordPress is
 CVE-2023-45802 (When a HTTP/2 stream was reset (RST frame) by a client, there was a ti ...)
 	{DSA-5662-1}
 	- apache2 2.4.58-1
-	[buster] - apache2 <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/19/6
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-45802
 	NOTE: https://github.com/icing/blog/blob/main/h2-rapid-reset.md#cve-2023-45802
@@ -78709,7 +78708,6 @@ CVE-2023-2258 (Improper Neutralization of Formula Elements in a CSV File in GitH
 CVE-2023-31122 (Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.Th ...)
 	{DSA-5662-1}
 	- apache2 2.4.58-1
-	[buster] - apache2 <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/19/4
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-31122
 	NOTE: Fixed by: https://github.com/apache/httpd/commit/c41eb3b14a3d1eb2e3c42c4728cc52a22748851a
@@ -347024,7 +347022,6 @@ CVE-2019-17568
 CVE-2019-17567 (Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configu ...)
 	[experimental] - apache2 2.4.48-1
 	- apache2 2.4.48-2
-	[buster] - apache2 <ignored> (Intrusive and risky backport)
 	[stretch] - apache2 <ignored> (Intrusive and risky backport)
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
 	NOTE: https://svn.apache.org/r1885605


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[24 May 2024] DLA-3818-1 apache2 - security update
+	{CVE-2019-17567 CVE-2023-31122 CVE-2023-38709 CVE-2023-45802 CVE-2024-24795 CVE-2024-27316}
+	[buster] - apache2 2.4.59-1~deb10u1
 [20 May 2024] DLA-3817-1 thunderbird - security update
 	{CVE-2024-4367 CVE-2024-4767 CVE-2024-4768 CVE-2024-4769 CVE-2024-4770 CVE-2024-4777}
 	[buster] - thunderbird 1:115.11.0-1~deb10u1


=====================================
data/dla-needed.txt
=====================================
@@ -31,9 +31,6 @@ ansible
   NOTE: 20231228: Made a partial release DLA-3695-1 (rouca), waiting for lee
   NOTE: 20240501: Update for bookworm-proposed-update: #1070193 (lee)
 --
-apache2 (Lee Garrett)
-  NOTE: 20240418: Added by Front-Desk (apo)
---
 atril
   NOTE: 20240121: Added by Front-Desk (apo)
   NOTE: 20240121: Decide whether it makes sense to disable comic feature or use libarchive instead.



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/10b3814a5b2eca9e3f242c88bb028e3cafc4258e

-- 
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/10b3814a5b2eca9e3f242c88bb028e3cafc4258e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240524/b08d56aa/attachment-0001.htm>