From e77b0b8ef188e6b274d22ca8f7feba51b35bb8fc Mon Sep 17 00:00:00 2001 From: Sylvain Beucler Date: Sat, 19 Feb 2022 16:59:34 +0100 Subject: Reserve DLA-2927-1 for twisted --- data/CVE/list.2020 | 2 -- data/DLA/list | 3 +++ data/dla-needed.txt | 2 -- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/data/CVE/list.2020 b/data/CVE/list.2020 index 05f13cab4a..9ceea64af2 100644 --- a/data/CVE/list.2020 +++ b/data/CVE/list.2020 @@ -49587,14 +49587,12 @@ CVE-2020-10109 (In Twisted Web through 19.10.0, there was an HTTP request splitt {DLA-2145-1} - twisted 18.9.0-7 (bug #953950) [buster] - twisted (Minor issue) - [stretch] - twisted (Minor issue) NOTE: https://know.bishopfox.com/advisories/twisted-version-19.10.0#INOR NOTE: https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 CVE-2020-10108 (In Twisted Web through 19.10.0, there was an HTTP request splitting vu ...) {DLA-2145-1} - twisted 18.9.0-7 (bug #953950) [buster] - twisted (Minor issue) - [stretch] - twisted (Minor issue) NOTE: https://know.bishopfox.com/advisories/twisted-version-19.10.0#INOR NOTE: https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 CVE-2020-10107 (PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XS ...) diff --git a/data/DLA/list b/data/DLA/list index 2387bd9c4a..21489709f1 100644 --- a/data/DLA/list +++ b/data/DLA/list @@ -1,3 +1,6 @@ +[19 Feb 2022] DLA-2927-1 twisted - security update + {CVE-2020-10108 CVE-2020-10109 CVE-2022-21712} + [stretch] - twisted 16.6.0-2+deb9u1 [18 Feb 2022] DLA-2926-1 zsh - security update {CVE-2021-45444} [stretch] - zsh 5.3.1-4+deb9u5 diff --git a/data/dla-needed.txt b/data/dla-needed.txt index 0ce305327e..ee8cc2c67b 100644 --- a/data/dla-needed.txt +++ b/data/dla-needed.txt @@ -75,8 +75,6 @@ thunderbird (Emilio) -- tiff (Thorsten Alteholz) -- -twisted (Sylvain Beucler) --- ujson (Anton) NOTE: 20220121: please reheck, at least the mentioned function is available in Stretch NOTE: 20220206: https://salsa.debian.org/lts-team/packages/ujson Investigating, whether affected or not (Anton) -- cgit v1.2.3