[Git][security-tracker-team/security-tracker][master] Reserve DLA-3858-1 for ruby2.7

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
26ad789f by Sylvain Beucler at 2024-09-02T14:19:32+02:00
Reserve DLA-3858-1 for ruby2.7

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -190699,7 +190699,6 @@ CVE-2022-28739 (There is a buffer over-read in Ruby before 2.6.10, 2.7.x before
 	{DLA-3450-1}
 	- ruby3.0 3.0.4-1 (bug #1009956)
 	- ruby2.7 <removed> (bug #1009957)
-	[bullseye] - ruby2.7 <postponed> (Minor issue, fix with next Ruby security release)
 	- ruby2.5 <removed>
 	- ruby2.3 <removed>
 	[stretch] - ruby2.3 <postponed> (Minor issue; fix in next LTS release)
@@ -249334,7 +249333,6 @@ CVE-2021-33621 (The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before
 	- ruby3.1 3.1.2-4 (bug #1024799)
 	- ruby3.0 <removed> (bug #1024800)
 	- ruby2.7 <removed>
-	[bullseye] - ruby2.7 <no-dsa> (Minor issue)
 	- ruby2.5 <removed>
 	NOTE: https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
 	NOTE: Fixed by: https://github.com/ruby/cgi/commit/64c5045c0a6b84fdb938a8465a0890e5f7162708 (v0.3.4)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[02 Sep 2024] DLA-3858-1 ruby2.7 - security update
+	{CVE-2021-33621 CVE-2022-28739 CVE-2023-28755 CVE-2023-28756 CVE-2023-36617 CVE-2024-27280 CVE-2024-27281 CVE-2024-27282}
+	[bullseye] - ruby2.7 2.7.4-1+deb11u2
 [26 Aug 2024] DLA-3857-1 libtommath - security update
 	{CVE-2023-36328}
 	[bullseye] - libtommath 1.2.0-6+deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -268,12 +268,6 @@ ruby-tzinfo (Adrian Bunk)
   NOTE: 20220723: Added by stable Security Team (jmm)
   NOTE: 20240815: Follow fixes from DLA-3077-1 (CVE-2022-31163) (Beuc/front-desk)
 --
-ruby2.7 (Sylvain Beucler)
-  NOTE: 20230508: Added by stable Security Team (jmm)
-  NOTE: 20240716: Samuel Henrique (samueloph) is working on a update
-  NOTE: 20240801: LTS contribution WIP at https://salsa.debian.org/lts-team/packages/ruby/-/commits/debian/bullseye/ (Beuc)
-  NOTE: 20240819: Waiting for bullseye-lts to accept uploads (Beuc)
---
 setuptools (dleidert)
   NOTE: 20240730: Added by oldstable Security Team (jmm)
   NOTE: 20240815: A bookworm DSA is planned (Beuc/front-desk)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26ad789fdea89d7f261cdbe36fa8156d8b3fbd04

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26ad789fdea89d7f261cdbe36fa8156d8b3fbd04
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240902/865e9393/attachment-0001.htm>