Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
193bb991 by Salvatore Bonaccorso at 2026-09-19T17:17:00+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -353,10 +353,10 @@ CVE-2025-15698 (The Business Name Generator WordPress
plugin through 1.3 does no
CVE-2017-20284 (Caucho Resin contains a path traversal vulnerability in the
documentat ...)
TODO: check
CVE-2026-93854 (In OpenStack Blazar before 17.0.1, the V2 lease API does not
enforce o ...)
- - blazar <unfixed>
+ - blazar <unfixed> (bug #1148408)
NOTE: https://launchpad.net/bugs/2162719
CVE-2026-93852 (In OpenStack Blazar before 17.0.1, the V2 lease listing
operation (GET ...)
- - blazar <unfixed>
+ - blazar <unfixed> (bug #1148408)
NOTE: https://launchpad.net/bugs/2162719
CVE-2026-93765 (Mongoid contains an unsafe reflection weakness in the document
persist ...)
NOT-FOR-US: Mongoid
@@ -375,23 +375,23 @@ CVE-2026-93759 (Mongoid does not neutralize a
string-typed query criterion suppl
CVE-2026-93758 (An insecure direct object reference in the nested attributes
handling ...)
NOT-FOR-US: Mongoid
CVE-2026-93753 (deepmerge through 4.3.1 contains a prototype poisoning
vulnerability i ...)
- - node-deepmerge <unfixed>
+ - node-deepmerge <unfixed> (bug #1148407)
NOTE: https://github.com/TehShrike/deepmerge/issues/273
CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability
in CSSS ...)
NOT-FOR-US: CSSOM
CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding
vulnerability ...)
- - node-uri-js <unfixed>
+ - node-uri-js <unfixed> (bug #1148403)
NOTE: https://github.com/garycourt/uri-js/issues/106
CVE-2026-93750 (http-cache-semantics through 4.2.0 contains a cache validation
vulnera ...)
- - node-got <unfixed>
+ - node-got <unfixed> (bug #1148406)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/57
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93749 (source-map-js through 1.2.1 fails to validate the per-section
offset l ...)
- - node-postcss <unfixed>
+ - node-postcss <unfixed> (bug #1148404)
NOTE: https://github.com/7rulnik/source-map-js/issues/76
NOTE: node-postcss embeds and provides node-source-map-js
CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate
security ...)
- - node-got <unfixed>
+ - node-got <unfixed> (bug #1148405)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/56
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the
ScheduleS ...)
@@ -399,14 +399,14 @@ CVE-2026-93737 (Azkaban through 4.0.0 omits project
permission checks in the Sch
CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the
ratings a ...)
NOT-FOR-US: Mealie
CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service
vulnerability in the ...)
- - node-uri-js <unfixed>
+ - node-uri-js <unfixed> (bug #1148402)
NOTE: https://github.com/garycourt/uri-js/issues/105
CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference
vulnerabi ...)
NOT-FOR-US: WinFsp
CVE-2026-93688 (SGLang through 0.5.19 in prefill/decode disaggregation mode
with Moonc ...)
NOT-FOR-US: SGLang
CVE-2026-93687 (braces through 3.0.3 contains a stack overflow vulnerability
in the re ...)
- - node-braces <unfixed>
+ - node-braces <unfixed> (bug #1148400)
NOTE: https://github.com/micromatch/braces/issues/70
CVE-2026-93685 (A flaw was found in the multicluster-observability-addon. A
remote att ...)
NOT-FOR-US: multicluster-observability-addon (Red Hat Advanced Cluster
Management for Kubernetes 2)
@@ -1770,20 +1770,20 @@ CVE-2026-85999 (Soup Sieve is a CSS selector library
designed to be used with Be
NOTE:
https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f
NOTE: Fixed by:
https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda
(2.9)
CVE-2026-85721 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-7grg-jcf7-rpmx
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/5ee2841cbf268bba4a200578be3938ccfc6cc6d6
(async-http-client-project-2.16.1)
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/e9f2f7423e0f6503f529656f2955a1317e56ba14
(async-http-client-project-2.16.1)
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/663a1a91757904b22cfe37e2e6049f1f8ea6ae59
(async-http-client-project-3.0.12)
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/e1871a19972fb496be1b8ac6be11d79e22ff2162
(async-http-client-project-3.0.12)
CVE-2026-85720 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-xr57-gcx8-52hf
NOTE: https://github.com/AsyncHttpClient/async-http-client/pull/2234
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/9dba5ac988b7e750551f59b2eab550b60ac8a0d6
(async-http-client-project-2.16.1)
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/d07dbc79f5cf378f63c246f6101d7579ace55acc
(async-http-client-project-3.0.12)
CVE-2026-85719 (The AsyncHttpClient (AHC) library allows Java applications to
easily e ...)
- - async-http-client <unfixed>
+ - async-http-client <unfixed> (bug #1148410)
NOTE:
https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x5w6-vm3f-pp6f
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5
(async-http-client-project-2.16.1)
NOTE: Fixed by:
https://github.com/AsyncHttpClient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d
(async-http-client-project-2.16.1)
@@ -5558,10 +5558,10 @@ CVE-2026-84850 (Improper certificate validation in the
shared HTTP client used b
CVE-2026-84829 (The Optimole WordPress plugin before 4.2.12 does not properly
escape ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84501 (An unauthenticated attacker can inject arbitrary fake log
lines into A ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y
CVE-2026-84439 (When audit logging is enabled (zookeeper.audit.enable=true),
an unauth ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6
CVE-2026-84408 (QND contains an improper access control vulnerability in a
named pipe, ...)
NOT-FOR-US: QND
@@ -6478,7 +6478,7 @@ CVE-2026-7514 (GitLab has remediated an issue in GitLab
CE/EE affecting all vers
CVE-2026-79994 (The guest-to-host Unix-domain socket relay in Docker Sandboxes
validat ...)
TODO: check
CVE-2026-79993 (The `deleteContainer` opcode (0x14/20) is processed without
verifying ...)
- - zookeeper <unfixed>
+ - zookeeper <unfixed> (bug #1148409)
NOTE: https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5
CVE-2026-79708 (GitLab has remediated an issue in GitLab EE affecting all
versions fro ...)
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as
src:gitlab, but never in a stable release)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/193bb9916836a11b021ad2958037dff3287b9e83
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
