mirror of
https://github.com/freedomofpress/dangerzone.git
synced 2025-04-28 09:52:37 +02:00
3ebc454b61
Update the Debian snapshot date to the current one, so that we always scan the latest image for CVEs. Refs #1057
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
# This configuration file will be used to track CVEs that we can ignore for the
|
|
# latest release of Dangerzone, and offer our analysis.
|
|
|
|
ignore:
|
|
# CVE-2023-45853
|
|
# ==============
|
|
#
|
|
# Debian tracker: https://security-tracker.debian.org/tracker/CVE-2023-45853
|
|
# Verdict: Dangerzone is not affected because the zlib library in Debian is
|
|
# built in a way that is not vulnerable.
|
|
- vulnerability: CVE-2023-45853
|
|
# CVE-2024-38428
|
|
# ==============
|
|
#
|
|
# Debian tracker: https://security-tracker.debian.org/tracker/CVE-2024-38428
|
|
# Verdict: Dangerzone is not affected because it doesn't use wget in the
|
|
# container image (which also has no network connectivity).
|
|
- vulnerability: CVE-2024-38428
|
|
# CVE-2024-57823
|
|
# ==============
|
|
#
|
|
# Debian tracker: https://security-tracker.debian.org/tracker/CVE-2024-57823
|
|
# Verdict: Dangerzone is not affected. First things first, LibreOffice is
|
|
# using this library for parsing RDF metadata in a document [1], and has
|
|
# issued a fix for the vendored raptor2 package they have for other distros
|
|
# [2].
|
|
#
|
|
# On the other hand, the Debian security team has stated that this is a minor
|
|
# issue [3], and there's no fix from the developers yet. It seems that the
|
|
# Debian package is not affected somehow by this CVE, probably due to the way
|
|
# it's packaged.
|
|
#
|
|
# [1] https://wiki.documentfoundation.org/Documentation/DevGuide/Office_Development#RDF_metadata
|
|
# [2] https://cgit.freedesktop.org/libreoffice/core/commit/?id=2b50dc0e4482ac0ad27d69147b4175e05af4fba4
|
|
# [2] From https://security-tracker.debian.org/tracker/CVE-2024-57823:
|
|
#
|
|
# [bookworm] - raptor2 <postponed> (Minor issue, revisit when fixed upstream)
|
|
#
|
|
- vulnerability: CVE-2024-57823
|