From ff53627b56bf1e544332538bf3333bde0645f1fe Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Fri, 10 Apr 2020 09:35:15 +0200 Subject: Add CVE-2020-10707/netty which we probably should drop The pull request referenced is the same as for CVE-2020-11612 and the issue correlation seem to be the same. This might be just a duplicate candidate assignment of CVE-2020-11612 itself thus. For now track it separately until situation on the CVE is clarified by either upstream or Red Hat as the assigning CNA for CVE-2020-10707. --- data/CVE/2020.list | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/data/CVE/2020.list b/data/CVE/2020.list index 9b1526aca1..6cfcd1df0f 100644 --- a/data/CVE/2020.list +++ b/data/CVE/2020.list @@ -2066,8 +2066,12 @@ CVE-2020-10709 RESERVED CVE-2020-10708 RESERVED -CVE-2020-10707 +CVE-2020-10707 [compression/decompression codecs don't enforce limits on buffer allocation sizes] RESERVED + - netty 1:4.1.48-1 + NOTE: https://github.com/netty/netty/pull/9924 + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1816216 + TODO: This seem to be a duplicate of CVE-2020-11612, pending request with Red Hat secalert CVE-2020-10706 RESERVED CVE-2020-10705 -- cgit v1.2.3