[Git][security-tracker-team/security-tracker][master] Associate some CVEs with jspdf and its itp bug

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5e7e1d12 by Salvatore Bonaccorso at 2025-03-20T19:59:22+01:00
Associate some CVEs with jspdf and its itp bug

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -334108,7 +334108,7 @@ CVE-2021-23355 (This affects all versions of package ps-kill. If (attacker-contr
 CVE-2021-23354 (The package printf before 0.6.1 are vulnerable to Regular Expression D ...)
 	NOT-FOR-US: Node printf
 CVE-2021-23353 (This affects the package jspdf before 2.3.1. ReDoS is possible via the ...)
-	NOT-FOR-US: Node jspdf
+	- jspdf <itp> (bug #998381)
 CVE-2021-23352 (This affects the package madge before 4.0.1. It is possible to specify ...)
 	NOT-FOR-US: Node madge
 CVE-2021-23351 (The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable ...)
@@ -405403,9 +405403,9 @@ CVE-2020-7692 (PKCE support is not implemented in accordance with the RFC for OA
 	NOTE: https://github.com/googleapis/google-oauth-java-client/issues/469
 	NOTE: https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824
 CVE-2020-7691 (In all versions of the package jspdf, it is possible to use <<script>s ...)
-	NOT-FOR-US: jspdf
+	- jspdf <itp> (bug #998381)
 CVE-2020-7690 (All affected versions <2.0.0 of package jspdf are vulnerable to Cross- ...)
-	NOT-FOR-US: jspdf
+	- jspdf <itp> (bug #998381)
 CVE-2020-7689 (Data is truncated wrong when its length is greater than 255 bytes.)
 	NOT-FOR-US: Node bcrypt
 CVE-2020-7688 (The issue occurs because tagName user input is formatted inside the ex ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e7e1d12dd94f6962ee5150c0dcaa29134de910c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e7e1d12dd94f6962ee5150c0dcaa29134de910c
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250320/84bda0e1/attachment.htm>