From c5b0ccf0d64c99201e3a8f31c8a5ad9c55c19ae6 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Thu, 30 Jan 2020 21:20:13 +0100 Subject: Mark CVE-2019-12290/libidn2 as no-dsa Furthermore the change is quite intrusive and too risky to solely ship via a security update. Rather the CVE fix should be postponed and proposed via a point release. --- data/CVE/list | 1 + 1 file changed, 1 insertion(+) diff --git a/data/CVE/list b/data/CVE/list index 2e8ad8f2ff..0d87f689f0 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -41219,6 +41219,7 @@ CVE-2019-12291 (HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Contro NOT-FOR-US: HashiCorp Consul CVE-2019-12290 (GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specifi ...) - libidn2 2.2.0-1 + [buster] - libidn2 (Minor issue; intrusive to backport) NOTE: https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5 (2.2.0) NOTE: https://gitlab.com/libidn/libidn2/merge_requests/71 CVE-2019-12289 (An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C782 ...) -- cgit v1.2.3