[Git][security-tracker-team/security-tracker][master] Track fixed version for some pypy3 issues with unstable upload

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
114f9a77 by Salvatore Bonaccorso at 2025-09-29T22:00:11+02:00
Track fixed version for some pypy3 issues with unstable upload

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -38188,7 +38188,7 @@ CVE-2025-4517 (Allows arbitrary filesystem writes outside the extraction directo
 	- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17, but dropped from sid with 3.9.13)
 	- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
 	[experimental] - pypy3 7.3.20+dfsg-1
-	- pypy3 <unfixed>
+	- pypy3 7.3.20+dfsg-2
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <no-dsa> (Minor issue)
 	[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to stdlib-3.9.17; embedding 3.6.9)
@@ -38211,7 +38211,7 @@ CVE-2025-4435 (When using a TarFile.errorlevel = 0and extracting with a filter t
 	- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17, but dropped from sid with 3.9.13)
 	- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
 	[experimental] - pypy3 7.3.20+dfsg-1
-	- pypy3 <unfixed>
+	- pypy3 7.3.20+dfsg-2
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <no-dsa> (Minor issue)
 	[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to stdlib-3.9.17; embedding 3.6.9)
@@ -38237,7 +38237,7 @@ CVE-2025-4330 (Allows the extraction filter to be ignored, allowing symlink targ
 	- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17, but dropped from sid with 3.9.13)
 	- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
 	[experimental] - pypy3 7.3.20+dfsg-1
-	- pypy3 <unfixed>
+	- pypy3 7.3.20+dfsg-2
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <no-dsa> (Minor issue)
 	[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to stdlib-3.9.17; embedding 3.6.9)
@@ -38261,7 +38261,7 @@ CVE-2025-4138 (Allows the extraction filter to be ignored, allowing symlink targ
 	- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17, but dropped from sid with 3.9.13)
 	- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
 	[experimental] - pypy3 7.3.20+dfsg-1
-	- pypy3 <unfixed>
+	- pypy3 7.3.20+dfsg-2
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <no-dsa> (Minor issue)
 	[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to stdlib-3.9.17; embedding 3.6.9)
@@ -38370,7 +38370,7 @@ CVE-2024-12718 (Allows modifying some file metadata (e.g. last modified) with fi
 	- python3.9 <not-affected> (Vulnerable code introduced in 3.12)
 	- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
 	[experimental] - pypy3 7.3.20+dfsg-1
-	- pypy3 <unfixed>
+	- pypy3 7.3.20+dfsg-2
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <no-dsa> (Minor issue)
 	[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to stdlib-3.9.17; embedding 3.6.9)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/114f9a77191039eb562e53ec38e87ab0c239a5f8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/114f9a77191039eb562e53ec38e87ab0c239a5f8
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250929/ee764f9b/attachment.htm>