[Git][security-tracker-team/security-tracker][master] 3 commits: CVE-2025-40924/libcatalyst-plugin-session-perl: bullseye postponed

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
faac3333 by Sylvain Beucler at 2025-07-18T17:50:59+02:00
CVE-2025-40924/libcatalyst-plugin-session-perl: bullseye postponed

- - - - -
69f0175f by Sylvain Beucler at 2025-07-18T17:52:22+02:00
CVE-2025-40923/libplack-middleware-session-perl: bullseye postponed

- - - - -
97e90b56 by Sylvain Beucler at 2025-07-18T17:56:30+02:00
CVE-2025-53643/python-aiohttp: bullseye postponed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -236,6 +236,7 @@ CVE-2025-7700 [NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec
 CVE-2025-40924 (Catalyst::Plugin::Session before version 0.44 for Perl generates sessi ...)
 	- libcatalyst-plugin-session-perl <unfixed> (bug #1109439)
 	[bookworm] - libcatalyst-plugin-session-perl <no-dsa> (Minor issue)
+	[bullseye] - libcatalyst-plugin-session-perl <postponed> (Minor issue, weak entropy for session ID)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/31252285/
 	NOTE: https://github.com/perl-catalyst/Catalyst-Plugin-Session/pull/5
 	NOTE: Fixed by: https://github.com/perl-catalyst/Catalyst-Plugin-Session/commit/c0e2b4ab1e42ebce1008286db8c571b6ee98c22c (v0.44)
@@ -612,6 +613,7 @@ CVE-2025-40919 (Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate t
 CVE-2025-40923 (Plack-Middleware-Session before version 0.35 for Perl generates sessio ...)
 	- libplack-middleware-session-perl <unfixed> (bug #1109405)
 	[bookworm] - libplack-middleware-session-perl <no-dsa> (Minor issue)
+	[bullseye] - libplack-middleware-session-perl <postponed> (Minor issue, weak entropy for session ID)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/31223483/
 	NOTE: https://github.com/plack/Plack-Middleware-Session/pull/52
 	NOTE: https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be (0.35)
@@ -1059,6 +1061,7 @@ CVE-2025-3621 (Vulnerabilities* in ActADUR local server product, developed and m
 CVE-2025-53643 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	- python-aiohttp <unfixed> (bug #1109336)
 	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
+	[bullseye] - python-aiohttp <postponed> (Minor issue; request smuggling)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
 	NOTE: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a (v3.12.14)
 CVE-2025-7628 (A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fb ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2df653bf9f82238cdb5c59cab9c8b83f810143f1...97e90b56c6072c94d72d843f35a798da710231fc

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2df653bf9f82238cdb5c59cab9c8b83f810143f1...97e90b56c6072c94d72d843f35a798da710231fc
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250718/9ba8d27a/attachment.htm>