Commit 02a96c8e authored by Salvatore Bonaccorso's avatar Salvatore Bonaccorso
Browse files

Update information on CVE-2018-1109/node-braces 

The issue does not affect any version released in Debian as the issue
was introduced only 2.2.0 upstream via the commit
https://github.com/micromatch/braces/commit/dcc1acab4de9a43e86ab4be4acde209ff1dca113
.

Thanks: Xavier Guimard <yadd@debian.org>
parent a5293dc5

data/CVE/list

+4 −3
Original line number Diff line number Diff line
@@ -81435,10 +81435,11 @@ CVE-2018-1110 [Improper Input Validation] 
	NOTE: http://www.openwall.com/lists/oss-security/2018/04/23/2

CVE-2018-1109

	RESERVED

	- node-braces <unfixed> (bug #927716)

	[stretch] - node-braces <ignored> (Nodejs in stretch not covered by security support)

	- node-braces <not-affected> (Vulnerable code introduced in 2.2.0)

	NOTE: https://snyk.io/vuln/npm:braces:20180219

	NOTE: https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451

	NOTE: Introduced by: https://github.com/micromatch/braces/commit/dcc1acab4de9a43e86ab4be4acde209ff1dca113 (2.2.0)

	NOTE: Fixed by: https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451 (2.3.1)

	NOTE: Cf. analysis in https://bugs.debian.org/927716#38

CVE-2018-1108 (kernel drivers before version 4.17-rc1 are vulnerable to a weakness in ...)

	- linux 4.16.5-1

	[jessie] - linux <not-affected> (Vulnerable code not present)