Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f259abc7 by Moritz Muehlenhoff at 2026-08-12T16:51:26+02:00
new undertow issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2057,13 +2057,15 @@ CVE-2026-17061 (A Deserialization of Untrusted Data
vulnerability affecting SIMU
CVE-2026-15567 (A flaw was found in Wildfly. A remote unauthenticated attacker
can tri ...)
- wildfly <itp> (bug #752018)
CVE-2026-15565 (A flaw was found in Undertow. A remote attacker can cause Out
of Memor ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490628
CVE-2026-15563 (A flaw was found in EAP's IIOP. The listener's NameService
would accep ...)
NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15562 (A flaw was found in EAP's jboss-remoting. A remote
unauthenticated att ...)
NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15561 (A flaw was found in EAP's undertow http/1.1 chunked-transfer
decoder. ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2483133
CVE-2026-15560 (when EAP runs with -secmgr, the openjdk-orb's JDKBridge
honours attack ...)
NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15556 (A flaw was found in Picketlink's SP signature validation; a
SAML respo ...)
@@ -2071,11 +2073,13 @@ CVE-2026-15556 (A flaw was found in Picketlink's SP
signature validation; a SAML
CVE-2026-15555 (A flaw was found in JBoss marshalling. The Infinispan session
replicat ...)
NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15554 (the Undertow AJP listener honours forged ssl_cert and is_ssl
AJP attri ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2480601
CVE-2026-15426 (The AcyMailing \u2013 An Ultimate Newsletter Plugin and
Marketing Auto ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14180 (A flaw was found in the ChunkReader component of the Undertow
HTTP ser ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2494771
CVE-2026-13739 (A legacy endpoint in Command Center contained an
unauthenticated serve ...)
NOT-FOR-US: Commvault
CVE-2026-13738 (CommServe contained an authorization bypass vulnerability
affecting a ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f259abc7b9a940072b0c5b8331b38b6f25f8cceb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f259abc7b9a940072b0c5b8331b38b6f25f8cceb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
