[Git][security-tracker-team/security-tracker][master] 2 commits: Update notes for CVE-2024-21510/ruby-sinatra.

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cbbb0bd8 by Chris Lamb at 2024-11-22T10:01:56+00:00
Update notes for CVE-2024-21510/ruby-sinatra.

- - - - -
5aa2eab2 by Chris Lamb at 2024-11-22T10:01:57+00:00
dla-needed.txt: Update note for ruby-sinatra.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -6856,8 +6856,8 @@ CVE-2024-47939 (Stack-based buffer overflow vulnerability exists in multiple Ric
 CVE-2024-21510 (Versions of the package sinatra from 0.0.0 are vulnerable to Reliance  ...)
 	- ruby-sinatra <unfixed> (bug #1087290)
 	NOTE: https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
-	NOTE: https://github.com/sinatra/sinatra/pull/2010
-	NOTE: WIP upstream fix: https://github.com/sinatra/sinatra/pull/2053
+	NOTE: https://github.com/sinatra/sinatra/pull/2053
+	NOTE: Rejected upstream fix: https://github.com/sinatra/sinatra/pull/2010
 CVE-2024-10620 (A vulnerability was found in knightliao Disconf 2.6.36. It has been cl ...)
 	NOT-FOR-US: knightliao Disconf
 CVE-2024-10619 (A vulnerability, which was classified as critical, was found in Tongda ...)


=====================================
data/dla-needed.txt
=====================================
@@ -194,6 +194,7 @@ redis (Adrian Bunk)
 --
 ruby-sinatra (Chris Lamb)
   NOTE: 20241110: Added by Front-Desk (apo)
+  NOTE: 20241122: Was awaiting approved upstream fix; still working on package. (lamby)
 --
 sogo
   NOTE: 20240922: Added by Front-Desk (apo)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/4a418373f0881aefdf2b8f83bfc91176d7aeffb2...5aa2eab255884aa064e7e7e32999774dcdbe8955

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/4a418373f0881aefdf2b8f83bfc91176d7aeffb2...5aa2eab255884aa064e7e7e32999774dcdbe8955
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241122/1c8c37a4/attachment.htm>