[Git][security-tracker-team/security-tracker][master] trixie triage

Moritz Muehlenhoff (@jmm) jmm at debian.org
Sat Apr 19 21:11:54 BST 2025



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3f3ae5d8 by Moritz Muehlenhoff at 2025-04-19T22:08:58+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -178186,6 +178186,7 @@ CVE-2023-29580 (yasm 1.3.0.55.g101bc was discovered to contain a segmentation vi
 	NOTE: Crash in CLI tool, no security impact
 CVE-2023-29579 (yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via th ...)
 	- yasm <unfixed> (bug #1035951)
+	[trixie] - yasm <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - yasm <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - yasm <no-dsa> (Minor issue)
 	[buster] - yasm <no-dsa> (Minor issue)
@@ -303825,11 +303826,12 @@ CVE-2021-3739 (A NULL pointer dereference flaw was found in the btrfs_rm_device
 	NOTE: https://www.openwall.com/lists/oss-security/2021/08/25/3
 CVE-2021-3735 (A deadlock issue was found in the AHCI controller device of QEMU. It o ...)
 	- qemu <unfixed> (bug #1014767)
+	[trixie] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[buster] - qemu <postponed> (Minor issue, waiting for patch)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1997184
-	NOTE: No upstream patch as of 2024-08-06
+	NOTE: No upstream patch as of 2025-04-19
 CVE-2021-40083 (Knot Resolver before 5.3.2 is prone to an assertion failure, triggerab ...)
 	[experimental] - knot-resolver 5.4.1-1
 	- knot-resolver 5.4.1-2 (bug #991463)
@@ -320334,6 +320336,7 @@ CVE-2021-33465 (An issue was discovered in yasm version 1.3.0. There is a NULL p
 	NOTE: Crash in CLI tool, no security impact
 CVE-2021-33464 (An issue was discovered in yasm version 1.3.0. There is a heap-buffer- ...)
 	- yasm <unfixed> (bug #1016353)
+	[trixie] - yasm <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - yasm <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - yasm <no-dsa> (Minor issue)
 	[buster] - yasm <no-dsa> (Minor issue)
@@ -356235,13 +356238,14 @@ CVE-2020-35504 (A NULL pointer dereference flaw was found in the SCSI emulation
 	NOTE: https://git.qemu.org/?p=qemu.git;a=commit;h=607206948cacda4a80be5b976dba
 CVE-2020-35503 (A NULL pointer dereference flaw was found in the megasas-gen2 SCSI hos ...)
 	- qemu <unfixed> (bug #979678)
+	[trixie] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[buster] - qemu <postponed> (Minor issue, waiting for sanctioned patch)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1910346
 	NOTE: https://lists.gnu.org/archive/html/qemu-devel/2020-12/msg06065.html
 	NOTE: https://patchew.org/QEMU/20201224175441.67538-1-mcascell@redhat.com/
-	NOTE: No sanctioned upstream patch as of 2024-08-06
+	NOTE: No sanctioned upstream patch as of 2025-04-19
 CVE-2020-35502 (A flaw was found in Privoxy in versions before 3.0.29. Memory leaks wh ...)
 	{DLA-2548-1}
 	- privoxy 3.0.29-1
@@ -372290,13 +372294,14 @@ CVE-2020-25744 (SaferVPN before 5.0.3.3 on Windows could allow low-privileged us
 	NOT-FOR-US: SaferVPN
 CVE-2020-25743 (hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereferen ...)
 	- qemu <unfixed> (bug #970940)
+	[trixie] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
 	[buster] - qemu <postponed> (Minor issue, waiting for sanctioned patch)
 	NOTE: https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01568.html
 	NOTE: https://patchew.org/QEMU/20200903183138.2161977-1-ppandit@redhat.com/
 	NOTE: https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fide_nullptr1
-	NOTE: No sanctioned upstream patch as of 2024-08-11
+	NOTE: No sanctioned upstream patch as of 2025-04-19
 CVE-2020-25742 (pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL p ...)
 	- qemu <unfixed> (bug #971390)
 	[bookworm] - qemu <postponed> (Minor issue, revisit when fixed upstream)
@@ -372680,14 +372685,11 @@ CVE-2020-25659 (python-cryptography 3.2 is vulnerable to Bleichenbacher timing a
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1889988
 	NOTE: https://github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494 (3.2)
 CVE-2020-25658 (It was found that python-rsa is vulnerable to Bleichenbacher timing at ...)
-	- python-rsa <unfixed> (bug #974685)
-	[bookworm] - python-rsa <postponed> (Minor issue, revisit when fixed upstream)
-	[bullseye] - python-rsa <no-dsa> (Minor issue)
-	[buster] - python-rsa <no-dsa> (Minor issue)
-	[stretch] - python-rsa <no-dsa> (Minor issue)
+	- python-rsa <unfixed> (unimportant; bug #974685)
 	NOTE: https://github.com/sybrenstuvel/python-rsa/issues/165
 	NOTE: Presumed fix upstream in 4.7 does not address the issue:
 	NOTE: https://github.com/sybrenstuvel/python-rsa/issues/165#issuecomment-727580521
+	NOTE: The library doesn't intend to guard against this: https://github.com/sybrenstuvel/python-rsa/issues/165#issuecomment-1603113867
 CVE-2020-25657 (A flaw was found in all released versions of m2crypto, where they are  ...)
 	- m2crypto 0.38.0-4 (bug #975002)
 	[bullseye] - m2crypto <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f3ae5d8e35e10149c78ded4625e86dacb1b4026

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f3ae5d8e35e10149c78ded4625e86dacb1b4026
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250419/088cb4ce/attachment.htm>


More information about the debian-security-tracker-commits mailing list