[Git][security-tracker-team/security-tracker][master] Add CVE-2025-40906/libbson-xs-perl

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
96321671 by Salvatore Bonaccorso at 2025-05-17T11:24:57+02:00
Add CVE-2025-40906/libbson-xs-perl

Rationale: The CVEs affecting libbbson-xs-perl due to issues in the
embedding libbson were addressed via the specific libbson CVEs, this CVE
is more to make aware of the overall situation around BSON::XS. Thus
mark it as unimporant and keep unfixed as no version is switching to a
libbson version bumping the version to a version including all fixes.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -199,7 +199,11 @@ CVE-2025-47534 (Missing Authorization vulnerability in ValvePress Wordpress Auto
 CVE-2025-46464 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2025-40906 (BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbso ...)
-	TODO: check
+	- libbson-xs-perl <removed> (unimportant)
+	NOTE: https://lists.security.metacpan.org/cve-announce/msg/29655123/
+	NOTE: The CVE assignment is specific to BSON::XS versions 0.8.4 bundling libbson 1.1.7
+	NOTE: with several CVEs affected. Fixes for those were covered in the corresponding
+	NOTE: CVEs.
 CVE-2025-40632 (Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11 ...)
 	NOT-FOR-US: Icewarp Mail Server
 CVE-2025-40631 (HTTP host header injection vulnerability in Icewarp Mail Server affect ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9632167158f04a55b68d7f11d127918b041b4467

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9632167158f04a55b68d7f11d127918b041b4467
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250517/d06d9992/attachment.htm>