Merge ~mainek00n/ubuntu-cve-tracker:patch-1 into ubuntu-cve-tracker:master

[MaineK00n]

[Mark Esler (eslerm)]

For active/CVE-2021-33503, it should be `upstream_python-urllib3: released (1.26.5)`.

This is a bit clearer if you look at:
 - https://github.com/urllib3/urllib3/releases/tag/1.26.4
 - https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec
 - https://github.com/urllib3/urllib3/releases/tag/1.26.5
(notice the dates)

You can also verify the commit with:
 - https://github.com/urllib3/urllib3/commits/1.26.4
 - https://github.com/urllib3/urllib3/commits/1.26.5

For the upstream field we want to know the upstream version number. What is the difference between an upstream version number and Debian's version number? What is the difference between those and Ubuntu?

https://www.ducea.com/2006/06/17/ubuntu-package-version-naming-explanation/

review: Needs Fixing

[Mark Esler (eslerm)]

A colleague corrected my suggestion.

For upstream_*, either the the actual upstream or Debian version is allowed (as you have it).

[MaineK00n (mainek00n)]

Thanks for the review.

I put the actual fixed version or the version that includes the fixed version in upstream_*. In some cases, the URL to the commit is added so that the user can find them.

In CVE-2020-26137, the version of python-urllib3 is changed to the actual upstream version instead of the Debian Version to match python-pip.

[Alex Murray (alexmurray)]

LGTM - thanks!

review: Approve

diff --git a/active/CVE-2020-26137 b/active/CVE-2020-26137
index a04d6b5..f713097 100644
--- a/active/CVE-2020-26137
+++ b/active/CVE-2020-26137
@@ -26,7 +26,7 @@ CVSS:
 
 Patches_python-urllib3:
  upstream: https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b (1.25.9)
-upstream_python-urllib3: released (1.25.9-1)
+upstream_python-urllib3: released (1.25.9)
 precise/esm_python-urllib3: DNE
 trusty_python-urllib3: ignored (reached end-of-life)
 trusty/esm_python-urllib3: needed
@@ -41,7 +41,8 @@ jammy_python-urllib3: not-affected (1.25.9-1)
 devel_python-urllib3: not-affected (1.25.9-1)
 
 Patches_python-pip:
-upstream_python-pip: needs-triage
+ upstream: https://github.com/pypa/pip/commit/072b70b9bf7819e87995728b480eaa71622b16a8 (20.2)
+upstream_python-pip: released (20.2)
 precise/esm_python-pip: DNE
 trusty_python-pip: ignored (reached end of life)
 trusty/esm_python-pip: needed
diff --git a/active/CVE-2021-33503 b/active/CVE-2021-33503
index 1e23fa5..07d45ff 100644
--- a/active/CVE-2021-33503
+++ b/active/CVE-2021-33503
@@ -28,7 +28,7 @@ CVSS:
  nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]
 
 Patches_python-urllib3:
-upstream_python-urllib3:
+upstream_python-urllib3: released (1.26.5)
 trusty_python-urllib3: ignored (reached end-of-life)
 trusty/esm_python-urllib3: not-affected
 xenial_python-urllib3: not-affected
@@ -42,7 +42,8 @@ jammy_python-urllib3: not-affected (1.26.5-1~exp1)
 devel_python-urllib3: not-affected (1.26.5-1~exp1)
 
 Patches_python-pip:
-upstream_python-pip:
+ upstream: https://github.com/pypa/pip/commit/5394d340fb3a0b31a8e1909dd6872ecc36f75fbe (21.2)
+upstream_python-pip: released (21.2)
 trusty_python-pip: ignored (reached end of life)
 trusty/esm_python-pip: not-affected (embedded urllib3 not affected)
 xenial_python-pip: not-affected (embedded urllib3 not affected)
diff --git a/active/CVE-2022-0085 b/active/CVE-2022-0085
index 37b6a2f..4d6eec7 100644
--- a/active/CVE-2022-0085
+++ b/active/CVE-2022-0085
@@ -19,7 +19,7 @@ CVSS:
 
 
 Patches_php-dompdf:
-upstream_php-dompdf: 
+upstream_php-dompdf: released (2.0.0)
 trusty/esm_php-dompdf: DNE (trusty was needs-triage)
 trusty_php-dompdf: ignored (out of standard support, was needs-triage)
 xenial_php-dompdf: ignored (end of standard support, was needs-triage)
diff --git a/retired/CVE-2021-28363 b/retired/CVE-2021-28363
index 51194a5..af59628 100644
--- a/retired/CVE-2021-28363
+++ b/retired/CVE-2021-28363
@@ -41,7 +41,8 @@ groovy_python-urllib3: not-affected (code not present)
 devel_python-urllib3: released (1.26.2-1ubuntu1)
 
 Patches_python-pip:
-upstream_python-pip:
+ upstream: https://github.com/pypa/pip/commit/960c01adce491de00ef7a8d02a32fea31b15a1dc (21.1)
+upstream_python-pip: released (21.1)
 precise/esm_python-pip: DNE
 trusty_python-pip: ignored (reached end of life)
 trusty/esm_python-pip: not-affected (code not present)