[Git][security-tracker-team/security-tracker][master] triage older issues

Tue Nov 5 13:59:51 GMT 2024


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
58fdeb7f by Moritz Muehlenhoff at 2024-11-05T14:59:42+01:00
triage older issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -15365,7 +15365,7 @@ CVE-2024-41718
 	REJECTED
 CVE-2024-41436 (ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via ...)
 	- clickhouse <removed> (bug #1082054)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
+	[bookworm] - clickhouse <ignored> (Minor issue)
 	[bullseye] - clickhouse <postponed> (Minor issue)
 	NOTE: https://github.com/ClickHouse/ClickHouse/issues/65520
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/66912
@@ -22682,9 +22682,7 @@ CVE-2024-6923 (There is a MEDIUM severity vulnerability affecting CPython.  The
 	NOTE: https://github.com/python/cpython/commit/06f28dc236708f72871c64d4bc4b4ea144c50147 (v3.10.15)
 	NOTE: https://github.com/python/cpython/commit/f7be505d137a22528cb0fc004422c0081d5d90e6 (v3.9.20)
 CVE-2024-6873 (It is possible to crash or redirect the execution flow of the ClickHou ...)
-	- clickhouse <removed> (bug #1077820)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
-	[bullseye] - clickhouse <no-dsa> (Minor issue)
+	- clickhouse <not-affected> (Vulnerable code introuced later, was also filed as #1077820)
 	NOTE: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-432f-r822-j66f
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/64024
 CVE-2024-6346 (The Gutenberg Blocks, Page Builder \u2013 ComboBlocks plugin for WordP ...)
@@ -29702,18 +29700,18 @@ CVE-2024-6501 (A flaw was found in NetworkManager. When a system running Network
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2295734
 CVE-2023-39329 (A flaw was found in OpenJPEG. A resource exhaustion can occur in the o ...)
 	- openjpeg2 <unfixed> (bug #1081910)
-	[bookworm] - openjpeg2 <no-dsa> (Minor issue)
+	[bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - openjpeg2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/uclouvain/openjpeg/issues/1474
 CVE-2023-39328 (A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This f ...)
 	- openjpeg2 <unfixed> (bug #1081909)
-	[bookworm] - openjpeg2 <no-dsa> (Minor issue)
+	[bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - openjpeg2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/uclouvain/openjpeg/issues/1471
 	NOTE: https://github.com/uclouvain/openjpeg/pull/1470
 CVE-2023-39327 (A flaw was found in OpenJPEG. Maliciously constructed pictures can cau ...)
 	- openjpeg2 <unfixed> (bug #1081908)
-	[bookworm] - openjpeg2 <no-dsa> (Minor issue)
+	[bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - openjpeg2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/uclouvain/openjpeg/issues/1472
 CVE-2024-6526 (A vulnerability classified as problematic has been found in CodeIgnite ...)
@@ -66352,7 +66350,7 @@ CVE-2024-1857 (The Ultimate Gift Cards for WooCommerce \u2013 Create, Redeem & M
 	NOT-FOR-US: WooCommerce plugin
 CVE-2024-2467 (A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA  ...)
 	- libcrypt-openssl-rsa-perl <unfixed> (bug #1066969)
-	[bookworm] - libcrypt-openssl-rsa-perl <no-dsa> (Minor issue)
+	[bookworm] - libcrypt-openssl-rsa-perl <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - libcrypt-openssl-rsa-perl <no-dsa> (Minor issue)
 	[buster] - libcrypt-openssl-rsa-perl <postponed> (Minor issue; side-channel timing attack)
 	NOTE: https://people.redhat.com/~hkario/marvin/
@@ -70644,6 +70642,8 @@ CVE-2024-22871 (An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an att
 	[buster] - clojure <postponed> (Minor issue)
 	NOTE: https://github.com/advisories/GHSA-vr64-r9qj-h27f
 	NOTE: https://hackmd.io/@fe1w0/rymmJGida
+	NOTE: https://clojure.atlassian.net/browse/CLJ-2839
+	NOTE: https://github.com/clojure/clojure/commit/06d450895e2d4028afaa4face17f8e597c772a24 (clojure-1.12.0-alpha9)
 CVE-2024-22532 (Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x8 ...)
 	NOT-FOR-US: XNSoft NConvert
 CVE-2024-21798 (ELECOM wireless LAN routers contain a cross-site scripting vulnerabili ...)
@@ -84696,10 +84696,7 @@ CVE-2023-49085 (Cacti provides an operational monitoring and fault management fr
 	NOTE: https://github.com/Cacti/cacti/commit/5f451bc680d7584525d18026836af2a1e31b2188 (release/1.2.26)
 	NOTE: Requires multi-pollers setup
 CVE-2023-48704 (ClickHouse is an open-source column-oriented database management syste ...)
-	- clickhouse <removed> (bug #1059367)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
-	[bullseye] - clickhouse <no-dsa> (Minor issue)
-	[buster] - clickhouse <no-dsa> (Minor issue)
+	- clickhouse <not-affected> (Vulnerable code introduced later, was also filed as #1059367)
 	NOTE: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/57107
 CVE-2023-48670 (Dell SupportAssist for Home PCs version 3.14.1 and prior versions cont ...)
@@ -84848,10 +84845,7 @@ CVE-2023-48685 (Railway Reservation System v1.0 is vulnerable to multiple Unauth
 CVE-2023-48308 (Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain  ...)
 	NOT-FOR-US: Nextcloud calendar app
 CVE-2023-48298 (ClickHouse\xae is an open-source column-oriented database management s ...)
-	- clickhouse <removed> (bug #1059261)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
-	[bullseye] - clickhouse <no-dsa> (Minor issue)
-	[buster] - clickhouse <no-dsa> (Minor issue)
+	- clickhouse <not-affected> (Vulnerable code introduced later, was also filed as #1059261)
 	NOTE: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/56795
 CVE-2023-46649 (A race condition in GitHub Enterprise Server was identified that could ...)
@@ -85223,11 +85217,9 @@ CVE-2023-47507 (Deserialization of Untrusted Data vulnerability in Master Slider
 CVE-2023-47236 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2023-47118 (ClickHouse\xae is an open-source column-oriented database management s ...)
-	- clickhouse <removed> (bug #1059261)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
-	[bullseye] - clickhouse <no-dsa> (Minor issue)
-	[buster] - clickhouse <no-dsa> (Minor issue)
+	- clickhouse <not-affected> (Vulnerable code introduced later, was also filed as #1059261)
 	NOTE: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-g22g-p6q2-x39v
+	NOTE: https://github.com/ClickHouse/ClickHouse/pull/56434
 CVE-2023-46311 (Authorization Bypass Through User-Controlled Key vulnerability in gVec ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2023-46149 (Unrestricted Upload of File with Dangerous Type vulnerability in Themi ...)
@@ -85861,7 +85853,7 @@ CVE-2023-48795 (The SSH transport protocol with certain OpenSSH extensions, foun
 	- python-asyncssh 2.15.0-1 (bug #1059007)
 	- tinyssh 20230101-4 (bug #1059058; unimportant)
 	- trilead-ssh2 <unfixed> (bug #1059294)
-	[bookworm] - trilead-ssh2 <no-dsa> (Minor issue)
+	[bookworm] - trilead-ssh2 <ignored> (Minor issue)
 	[bullseye] - trilead-ssh2 <no-dsa> (Minor issue)
 	[buster] - trilead-ssh2 <no-dsa> (Minor issue)
 	NOTE: https://terrapin-attack.com/
@@ -100106,7 +100098,7 @@ CVE-2023-43909 (Hospital Management System thru commit 4770d was discovered to c
 CVE-2023-43655 (Composer is a dependency manager for PHP. Users publishing a composer. ...)
 	{DLA-3777-1}
 	- composer 2.6.4-1
-	[bookworm] - composer <no-dsa> (Minor issue)
+	[bookworm] - composer <postponed> (Minor issue, fix along in a future update)
 	[bullseye] - composer <no-dsa> (Minor issue)
 	NOTE: https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf
 	NOTE: https://github.com/composer/composer/commit/4fce14795aba98e40b6c4f5047305aba17a6120d (1.10.27)
@@ -162031,13 +162023,13 @@ CVE-2022-44012 (An issue was discovered in /DS/LM_API/api/SelectionService/Inser
 	NOT-FOR-US: Simmeth Lieferantenmanager
 CVE-2022-44011 (An issue was discovered in ClickHouse before 22.9.1.2603. An authentic ...)
 	- clickhouse <removed> (bug #1059261)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
+	[bookworm] - clickhouse <ignored> (Minor issue)
 	[bullseye] - clickhouse <no-dsa> (Minor issue)
 	[buster] - clickhouse <postponed> (Minor issue, DoS)
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/40241
 CVE-2022-44010 (An issue was discovered in ClickHouse before 22.9.1.2603. An attacker  ...)
 	- clickhouse <removed> (bug #1059261)
-	[bookworm] - clickhouse <no-dsa> (Minor issue)
+	[bookworm] - clickhouse <ignored> (Minor issue)
 	[bullseye] - clickhouse <no-dsa> (Minor issue)
 	[buster] - clickhouse <postponed> (Minor issue, DoS)
 	NOTE: https://github.com/ClickHouse/ClickHouse/pull/40292



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58fdeb7f270b097208a8e4cdde8f0e61b2f8fe58

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58fdeb7f270b097208a8e4cdde8f0e61b2f8fe58
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241105/56e7b8c2/attachment.htm>
