#1008045 bullseye-pu: package node-mermaid/8.7.0+ds+~cs27.17.17-3+deb11u1

Package:
release.debian.org
Source:
release.debian.org
Submitter:
Yadd
Date:
2022-07-09 10:51:36 UTC
Severity:
normal
Tags:
#1008045#5
Date:
2022-03-21 13:09:09 UTC
From:
To:
[ Reason ]
node-mermaid is vulnerable to XSS attack (CVE-2021-23648)

[ Impact ]
medium vulnerability

[ Tests ]
Test passed, new upstream test not applicable here

[ Risks ]
Low risk, patch is trivial

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Decode HTML entities before parsing URLs

Cheers,
Yadd
#1008045#10
Date:
2022-05-28 20:20:40 UTC
From:
To:
Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam
#1008045#17
Date:
2022-05-29 18:02:32 UTC
From:
To:
package release.debian.org
tags 1008045 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-mermaid
Version: 8.7.0+ds+~cs27.17.17-3+deb11u1

Explanation: fix cross-site scripting issue [CVE-2021-23648]
#1008045#22
Date:
2022-05-29 18:02:32 UTC
From:
To:
package release.debian.org
tags 1008045 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-mermaid
Version: 8.7.0+ds+~cs27.17.17-3+deb11u1

Explanation: fix cross-site scripting issue [CVE-2021-23648]
#1008045#27
Date:
2022-06-21 06:30:26 UTC
From:
To:
Hi Yadd,

Could you fix as well CVE-2021-43861 in the next point release? Should
be then on top of the already uploaded +deb11u1.

Regards,
Salvatore
#1008045#32
Date:
2022-07-02 05:09:14 UTC
From:
To:
Hi,

done (8.7.0+ds+~cs27.17.17-3+deb11u2), just pushed to Bullseye queue

Regards,
Yadd
#1008045#37
Date:
2022-07-02 17:16:10 UTC
From:
To:
package release.debian.org
tags 1008045 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-mermaid
Version: 8.7.0+ds+~cs27.17.17-3+deb11u2

Explanation: fix cross-site scripting issue [CVE-2021-43861]
#1008045#40
Date:
2022-07-02 17:16:10 UTC
From:
To:
package release.debian.org
tags 1008045 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-mermaid
Version: 8.7.0+ds+~cs27.17.17-3+deb11u2

Explanation: fix cross-site scripting issue [CVE-2021-43861]
#1008045#45
Date:
2022-07-09 10:47:43 UTC
From:
To:
(re-sending with fixed bug numbers)

Hi,

The updates discussed in these bugs were included in today's bullseye
point release.

Regards,

Adam