it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
- From: Sebastien Delafond <seb AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 4907-1] composer security update
- Date: Thu, 29 Apr 2021 16:50:09 +0000
- Authentication-results: mail02.piratenpartei.de; dkim=none; dmarc=none; spf=none (mail02.piratenpartei.de: domain of "bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org" has no SPF policy when checking 82.195.75.100) smtp.mailfrom="bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org"
- List-archive: https://lists.debian.org/msgid-search/E1lc9rd-0002Wa-5z AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version :Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=SlDc3j4J28VwErIu11dpfIRc81IjxTNYP543m4KYyZs=; b=o9 QYcns4iER1YVu23RfFyRtJk910Bl6My92TtpirOWid5PBlCb5TKm9E+K+LnYxZkv5oC1kOGlg8Ojs M+Xh/KPmmeVwOjR/oIXbM8aahf1/HatWLxg9yp1eleTfKq/h37OnkC8IqKktYGPE4xd3mVtCMycPw YnqKMYMGQIm4lDWARZgcw8CVbRlaZqLJkBcLMhPp4QZsT5J5vkt5Aa6o5bW+oDdYNqxQ1UxpPwxyZ bk7fCBD5bVLhQ4aZDSdt1l2vYXH43Syn2XYJt8ZqzjS1HlvlNaQX6xDT4SWhAbH4e4ltWcM/Luq8+ npnPmJuUfpzH8UwoxHfzLgQ+fryU9JGg==;
- Old-return-path: <seb AT seger.debian.org>
- Priority: urgent
- Resent-date: Thu, 29 Apr 2021 16:50:26 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <TCw-vRh2XsO.A.dj.SPuigB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-4907-1 security AT debian.org
https://www.debian.org/security/ Sebastien Delafond
April 29, 2021 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : composer
CVE ID : CVE-2021-29472
It was discovered that composer, a dependency manager for PHP, did not
properly sanitize Mercurial URLs, which could lead to arbitrary code
execution.
For the stable distribution (buster), this problem has been fixed in
version 1.8.4-1+deb10u1.
We recommend that you upgrade your composer packages.
For the detailed security status of composer please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/composer
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmCK4LkACgkQEL6Jg/PV
nWQhBwgArIovQUUooqTS91bHsjuqtP5cXvbbeSbLml9cRug6U83QJEeDOnLz/ljd
K0gZLZIHAi7B9iMX/oeSA73VYmSyfEp1DhSaluGSMkbvzptONDt6j/wKc23Zr/A8
C8/wcD1k4rIC3VmyEWNKtO/qZZ+nt/WX6Fpq4PrlOdhO3ea/hctzlz3UacVoThwD
HSHBHn5pWQygHQYdWva/HNeeEtwE81gBaQ3BYYJ+NWgZilfHW2pU5ilhWi2jur3z
nwgpqIKVhfhC3jG4552n15E5i5T28LR8IXfijtHr91b4Q2ZtVdKQdSYs8UO0+jA8
Lz0xVj6CyVNsrmXe3fMzkIVeIzA04g==
=2MWQ
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 4907-1] composer security update, Sebastien Delafond, 29.04.2021
Archiv bereitgestellt durch MHonArc 2.6.24.