about summary refs log tree commit diff
path: root/blacklisting/blacklist.xml
blob: 9c3339597148058c87ee00657456c19438497549 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
<blacklist>


<item id='openssl-0.9.7d-obsolete'>
  <condition>
    <within>
      <traverse><true /></traverse>
      <hasAttr name='outputHash' value='1b49e90fc8a75c3a507c0a624529aca5' />
    </within>
  </condition>
  <reason>
    Race condition in CRL checking code.  Upgrade to 0.9.7e.
  </reason>
  <severity class="all" level="low" />
</item>


<item id='zlib-1.2.1-security' type='security'>
  <condition>
    <within>
      <traverse>
        <not><hasAttr name='outputHash' value='.+' /></not>
      </traverse>
      <hasAttr name='outputHash' value='ef1cb003448b4a53517b8f25adb12452' />
    </within>
  </condition>
  <reason>
    Zlib 1.2.1 is vulnerable to a denial-of-service condition.  See
    http://www.kb.cert.org/vuls/id/238678.  Upgrade to 1.2.2.
  </reason>
  <severity class="server" level="critical" />
  <severity class="client" level="medium" />
</item>


<!--
<item id='libpng-1.2.7-crash'>
  <condition>
    <containsName name="libpng" comparison="lte" version="1.2.7" />
  </condition>
  <reason>
    libpng 1.2.7 is vulnerable to a crash bug.  See
    http://www.libpng.org/pub/png/libpng.html.  Upgrade to 1.2.8.
  </reason>
  <severity class="client" level="low" />
</item>
-->


<!--
<item id='subversion-without-zlib' type='improvement'>

  <condition>
    <withinOutputClosure>
      <not>
        <containsName name='zlib' />
      </not>
    </withinOutputClosure>
  </condition>

  <reason>
    Subversion can be compiled with Zlib compression support, which is a good thing.
  </reason>

</item>
-->

</blacklist>