[Git][security-tracker-team/security-tracker][master] Reserve DLA-3859-1 for systemd

[Adrian Bunk (@bunk)]

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b4fb357d by Adrian Bunk at 2024-09-02T17:03:26+03:00
Reserve DLA-3859-1 for systemd

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -58997,7 +58997,6 @@ CVE-2023-50387 (Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4
 	- unbound 1.19.1-1 (bug #1063845)
 	- systemd 255.4-1
 	[bookworm] - systemd 252.23-1~deb12u1
-	[bullseye] - systemd <no-dsa> (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release)
 	[buster] - systemd <no-dsa> (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release)
 	- dnsjava <unfixed> (bug #1077750)
 	[bookworm] - dnsjava <no-dsa> (Minor issue)
@@ -59046,7 +59045,6 @@ CVE-2023-50868 (The Closest Encloser Proof aspect of the DNS protocol (in RFC 51
 	- unbound 1.19.1-1 (bug #1063845)
 	- systemd 255.4-1
 	[bookworm] - systemd 252.23-1~deb12u1
-	[bullseye] - systemd <no-dsa> (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release)
 	[buster] - systemd <no-dsa> (DNSSEC is disabled by default in systemd-resolved; can be fixed via point release)
 	- dnsjava <unfixed> (bug #1077751)
 	[bookworm] - dnsjava <no-dsa> (Minor issue)
@@ -69148,7 +69146,6 @@ CVE-2023-7018 (Deserialization of Untrusted Data in GitHub repository huggingfac
 CVE-2023-7008 (A vulnerability was found in systemd-resolved. This issue may allow sy ...)
 	- systemd 255.1-3 (bug #1059278)
 	[bookworm] - systemd 252.21-1~deb12u1
-	[bullseye] - systemd <no-dsa> (Minor issue)
 	[buster] - systemd <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2222672
 	NOTE: https://github.com/systemd/systemd/issues/25676


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[02 Sep 2024] DLA-3859-1 systemd - security update
+	{CVE-2023-7008 CVE-2023-50387 CVE-2023-50868}
+	[bullseye] - systemd 247.3-7+deb11u6
 [02 Sep 2024] DLA-3858-1 ruby2.7 - security update
 	{CVE-2021-33621 CVE-2022-28739 CVE-2023-28755 CVE-2023-28756 CVE-2023-36617 CVE-2024-27280 CVE-2024-27281 CVE-2024-27282}
 	[bullseye] - ruby2.7 2.7.4-1+deb11u2


=====================================
data/dla-needed.txt
=====================================
@@ -283,10 +283,6 @@ squid
   NOTE: 20240308: the fix for CVE-2023-5824 is kind of intrusive. (apo)
   NOTE: 20240815: A bookworm DSA is planned (Beuc/front-desk)
 --
-systemd (Adrian Bunk)
-  NOTE: 20240815: Added by Front-Desk (Beuc)
-  NOTE: 20240815: Follow fixes from bookworm 12.5 and 12.6 (3 CVEs) (Beuc/front-desk)
---
 texlive-bin
   NOTE: 20240815: Added by Front-Desk (Beuc)
   NOTE: 20240815: Follow fixes from bookworm 12.1 (CVE-2023-32668) (Beuc/front-desk)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b4fb357d88111fe34f0ae2f46439da67d0bbe185

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b4fb357d88111fe34f0ae2f46439da67d0bbe185
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240902/3d3dd167/attachment-0001.htm>