Branch: master New this week: 2 CVEs CVE-2022-48303 (CVSS3: 7.8 HIGH): tar https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48303 * CVE-2023-25139 (CVSS3: 9.8 CRITICAL): glibc

Branch: langdale New this week: 7 CVEs CVE-2022-3094 (CVSS3: 7.5 HIGH): bind https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3094 * CVE-2022-3736 (CVSS3: 7.5 HIGH): bind

Branch: kirkstone New this week: 7 CVEs CVE-2022-3094 (CVSS3: 7.5 HIGH): bind https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3094 * CVE-2022-3736 (CVSS3: 7.5 HIGH): bind

Branch: dunfell New this week: 4 CVEs CVE-2022-42919 (CVSS3: 7.8 HIGH): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42919 * CVE-2022-48281 (CVSS3: 5.5 MEDIUM):

Branch: master New this week: 7 CVEs CVE-2022-3094 (CVSS3: 7.5 HIGH): bind https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3094 * CVE-2022-3736 (CVSS3: 7.5 HIGH): bind

Patches sent (upgrade and ignore). NIST haven’t taken the CPE fixes I sent, re-sent. This was fixed by a patch on the list that was incorrectly labelled as langdale, I’ve reposted it. Both

Branch: langdale New this week: 7 CVEs CVE-2022-23521 (CVSS3: 9.8 CRITICAL): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23521 * CVE-2022-3515 (CVSS3: 9.8 CRITICAL):

Branch: kirkstone New this week: 7 CVEs CVE-2022-23521 (CVSS3: 9.8 CRITICAL): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23521 * CVE-2022-3515 (CVSS3: 9.8 CRITICAL):

Branch: dunfell New this week: 5 CVEs CVE-2022-23521 (CVSS3: 9.8 CRITICAL): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23521 * CVE-2022-41903 (CVSS3: 9.8 CRITICAL): git

Branch: master New this week: 3 CVEs CVE-2022-23521 (CVSS3: 9.8 CRITICAL): git https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23521 * CVE-2022-41903 (CVSS3: 9.8 CRITICAL): git

Lets put it in the manual. The wiki is good to pull together info but I'd like the manual to be definitive. I've thought this about patch submission for a while too, we have too many docs with the

I guess whilst the CVE triage process is actually quite simple, there’s a few non-obvious steps. I’ve started braindumping into https://wiki.yoctoproject.org/wiki/CVE_Triage, when it’s expanded

This is quite often the case, perhaps those weekly reports could include a pointer on how to do that? Alex

These are fixed in xserver-org 21.1.6, I’ve mailed to get the CPE updated. Montavista sent a patch for kirkstone, I’ve asked that they post it for master/langdale too. xdg-email is a mess.

Branch: langdale New this week: 3 CVEs CVE-2020-10735 (CVSS3: 7.5 HIGH): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10735 * CVE-2022-3515 (CVSS3: 9.8 CRITICAL):

Branch: kirkstone New this week: 2 CVEs CVE-2022-3515 (CVSS3: 9.8 CRITICAL): gnupg:gnupg-native:libksba:libksba-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3515 * CVE-2023-0288

Branch: dunfell New this week: 2 CVEs CVE-2022-3515 (CVSS3: 9.8 CRITICAL): gnupg:gnupg-native:libksba:libksba-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3515 * CVE-2023-0288

Branch: master New this week: 0 CVEs Removed this week: 3 CVEs CVE-2023-0049 (CVSS3: 7.8 HIGH): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0049 * CVE-2023-0051 (CVSS3: 7.8 HIGH):

Branch: langdale New this week: 3 CVEs CVE-2023-0049 (CVSS3: 7.8 HIGH): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0049 * CVE-2023-0051 (CVSS3: 7.8 HIGH): vim

Branch: kirkstone New this week: 3 CVEs CVE-2023-0049 (CVSS3: 7.8 HIGH): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0049 * CVE-2023-0051 (CVSS3: 7.8 HIGH): vim