Daniel Leidert pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
bd5288b1 by Daniel Leidert at 2025-05-31T03:13:16+02:00
Minor rephrasing
- - - - -
9864a09a by Daniel Leidert at 2025-05-31T03:13:17+02:00
Update information for CVE-2024-6844
Add patch links and postponed flag for Bullseye.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -23961,9 +23961,12 @@ CVE-2024-6851 (In version 3.22.0 of aimhubio/aim, the
LocalFileManager._cleanup
NOT-FOR-US: aimhubio/aim
CVE-2024-6844 (A vulnerability in corydolphin/flask-cors version 4.0.1 allows
for inc ...)
- python-flask-cors 6.0.0-1 (bug #1100988)
- [bookworm] - python-flask-cors <postponed> (Minor issue, revisit when
fixed upstream)
+ [bookworm] - python-flask-cors <postponed> (Minor issue)
+ [bullseye] - python-flask-cors <postponed> (Minor issue)
NOTE: https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0
NOTE: https://github.com/corydolphin/flask-cors/issues/385
+ NOTE: https://github.com/advisories/GHSA-8vgw-p6qm-5gr7
+ NOTE: Fixed by:
https://github.com/corydolphin/flask-cors/commit/35d875319621bd129a38b2b823abf4a2f6cda536
(6.0.0)
CVE-2024-6842 (In version 1.5.5 of mintplex-labs/anything-llm, the
`/setup-complete` ...)
NOT-FOR-US: mintplex-labs/anything-llm
CVE-2024-6841 (A Cross-Site Request Forgery (CSRF) vulnerability exists in the
latest ...)
@@ -23974,8 +23977,8 @@ CVE-2024-6839 (corydolphin/flask-cors version 4.0.1
contains an improper regex p
[bullseye] - python-flask-cors <postponed> (Minor issue)
NOTE: https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4
NOTE: https://github.com/advisories/GHSA-7rxf-gvfg-47g4
- NOTE:
https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f
(6.0.0, incomplete fix)
- NOTE: https://github.com/corydolphin/flask-cors/pull/392 (follow-up for
incomplete fix)
+ NOTE: Fixed by:
https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f
(6.0.0, incomplete fix)
+ NOTE: Fixed by: https://github.com/corydolphin/flask-cors/pull/392
(follow-up)
CVE-2024-6838 (In mlflow/mlflow version v2.13.2, a vulnerability exists that
allows t ...)
NOT-FOR-US: mlflow
CVE-2024-6829 (A vulnerability in aimhubio/aim version 3.19.3 allows an
attacker to e ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/552a7c711d2c83226e289b7c489d6059ed194c6d...9864a09a3083a53f016b3455b91510b98d383356
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/552a7c711d2c83226e289b7c489d6059ed194c6d...9864a09a3083a53f016b3455b91510b98d383356
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
