Hi Pieter, On Sun, Nov 01, 2026 at 03:44:25PM +0100, Pieter Lenaerts wrote: > On Sun Nov 1, 2026 at 2:46 PM CET, Salvatore Bonaccorso wrote: > > Hi Salvatore, > > > > Source: pypdf > > Source-Version: 6.21.4-1 > > > > Fixes a bunch of CVEs, closing manually for #1152684. > > I had a look from the changelog, but couldn't decide with certainty which it > fixed and which not. > > Where did you find a mapping to the CVE's?
The CVEs appeared in the CVE feed and so we did some triaging, the CVe entries contained mappings to the respective GHSA. Unfortunately those were not added back to the GHSA's itself (in some cases). E.g. let's taike the first one in the bugreport CVE-2026-115572, which has a link to https://security-tracker.debian.org/tracker/CVE-2026-115572 there we already added what we triaged, as: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw https://github.com/py-pdf/pypdf/pull/4240 Fixed by: https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b (6.21.2) this corresponds to the CVE entry at MITRE: https://www.cve.org/CVERecord?id=CVE-2026-115572 which contains the reference to https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw . The GHSA itself lists as well then the CVE as CVE-2026-115572 . In some cases you will though see no CVE "backfilled" to the GHSA entry. But for Debian purposes you can take the security-tracker entries as autoritative (unless we did some mistakes, which happens, we are humans ;-)). Does this help? Regards, Salvatore
