[Git][security-tracker-team/security-tracker][master] bookworm triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
96b9f9f6 by Moritz Muehlenhoff at 2025-07-04T09:51:57+02:00
bookworm triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -2801,8 +2801,11 @@ CVE-2025-6496 (A vulnerability was found in HTACG tidy-html5 5.8.0. It has been
 	[bookworm] - tidy-html5 <postponed> (Minor issue, revisit when fixed upstream)
 	NOTE: https://github.com/htacg/tidy-html5/issues/1141
 CVE-2025-6494 (A vulnerability was found in sparklemotion nokogiri c29c920907366cb74a ...)
-	- ruby-nokogiri <unfixed> (bug #1108237)
+	- ruby-nokogiri <not-affected> (Vulnerable code not present, bug #1108237)
+	NOTE: Introduced in: https://github.com/sparklemotion/nokogiri/commit/c29c920907366cb74af13b4dc2230e9c9e23b833
+	NOTE: Fixed in: https://github.com/sparklemotion/nokogiri/commit/a17dec46112931a3f43dd21c004e8418457166ef
 	NOTE: https://github.com/sparklemotion/nokogiri/issues/3508
+	NOTE: https://github.com/sparklemotion/nokogiri/pull/3524
 CVE-2025-6493 (A vulnerability was found in CodeMirror up to 5.17.0 and classified as ...)
 	- codemirror-js <unfixed> (bug #1108477)
 	NOTE: https://github.com/codemirror/codemirror5/issues/7128
@@ -2814,8 +2817,11 @@ CVE-2025-52926 (In scan.rs in spytrap-adb before 0.3.5, matches for known stalke
 CVE-2025-6492 (A vulnerability has been found in MarkText up to 0.17.1 and classified ...)
 	NOT-FOR-US: MarkText
 CVE-2025-6490 (A vulnerability was found in sparklemotion nokogiri c29c920907366cb74a ...)
-	- ruby-nokogiri <unfixed> (bug #1108238)
-	NOTE: https://github.com/sparklemotion/nokogiri/issues/3500
+	- ruby-nokogiri <not-affected> (Vulnerable code not present, bug #1108238)
+	NOTE: Introduced in: https://github.com/sparklemotion/nokogiri/commit/c29c920907366cb74af13b4dc2230e9c9e23b833
+	NOTE: Fixed in: https://github.com/sparklemotion/nokogiri/commit/a17dec46112931a3f43dd21c004e8418457166ef
+	NOTE: https://github.com/sparklemotion/nokogiri/issues/3508
+	NOTE: https://github.com/sparklemotion/nokogiri/pull/3524
 CVE-2025-6489 (A vulnerability has been found in itsourcecode Agri-Trading Online Sho ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2025-6487 (A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It  ...)
@@ -10269,6 +10275,7 @@ CVE-2025-29632 (Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote
 	NOT-FOR-US: Free5gc
 CVE-2025-27151 (Redis is an open source, in-memory database that persists on disk. In  ...)
 	- redis <unfixed> (bug #1106822)
+	[bookworm] - redis <no-dsa> (Minor issue)
 	[bullseye] - redis <not-affected> (Vulnerable code not present)
 	- redict <unfixed> (bug #1106823)
 	- valkey 8.1.1+dfsg1-1.1 (bug #1106824)


=====================================
data/dsa-needed.txt
=====================================
@@ -26,6 +26,8 @@ gh
 --
 guix
 --
+jackson-core
+--
 libreswan
   Waiting on feedback from maintainer
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/96b9f9f637389a6cd35e8e601d5409df60a24cdc

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/96b9f9f637389a6cd35e8e601d5409df60a24cdc
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250704/33547d01/attachment.htm>