Carlos Henrique Lima Melara pushed to branch master at Debian Security Tracker
/ security-tracker
Commits:
df20250a by Carlos Henrique Lima Melara at 2026-09-29T00:01:41-03:00
Reserve DLA-4800-1 for glance
- - - - -
65e6431a by Carlos Henrique Lima Melara at 2026-09-29T00:27:28-03:00
Reserve DLA-4801-1 for swift
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -32653,17 +32653,14 @@ CVE-2026-81738 (OpenVPN 2.5.0 through 2.7.6 on
Windows using the tap-windows6 dr
CVE-2026-71198 (In OpenStack Glance before 32.0.1, the location API does not
validate ...)
- glance 2:32.0.0-4 (bug #1146594)
[trixie] - glance <no-dsa> (Minor issue)
- [bookworm] - glance <postponed> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-038.html
CVE-2026-71197
- glance 2:32.0.0-4 (bug #1146594)
[trixie] - glance <no-dsa> (Minor issue)
- [bookworm] - glance <postponed> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-038.html
CVE-2026-71196
- glance 2:32.0.0-4 (bug #1146594)
[trixie] - glance <no-dsa> (Minor issue)
- [bookworm] - glance <postponed> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-038.html
CVE-2026-9854 (A vulnerability exists in SYS600 RBAC mechanism where users
having acc ...)
NOT-FOR-US: Hitachi Energy
@@ -61371,7 +61368,6 @@ CVE-2026-XXXX [OSSN-0106: API ramdisk endpoints require
network-level access con
CVE-2026-77648 (In OpenStack Glance through 32.0.0, the /v2/tasks API accepts
type=imp ...)
- glance 2:32.0.0-3 (bug #1144212)
[trixie] - glance <no-dsa> (Minor issue)
- [bookworm] - glance <postponed> (Minor issue)
NOTE: https://wiki.openstack.org/wiki/OSSN/OSSN-0105
NOTE: https://bugs.launchpad.net/glance/+bug/2152110
CVE-2026-12061
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,9 @@
+[29 Sep 2026] DLA-4801-1 swift - security update
+ {CVE-2026-71191 CVE-2026-97149}
+ [bookworm] - swift 2.30.1-0+deb12u3
+[29 Sep 2026] DLA-4800-1 glance - security update
+ {CVE-2026-71196 CVE-2026-71197 CVE-2026-71198 CVE-2026-77648}
+ [bookworm] - glance 2:25.1.0-2+deb12u5
[28 Sep 2026] DLA-4799-1 lxml - security update
{CVE-2026-28348 CVE-2026-28350 CVE-2026-41066 CVE-2026-49825}
[bookworm] - lxml 4.9.2-1+deb12u1
=====================================
data/dla-needed.txt
=====================================
@@ -748,18 +748,6 @@ suricata-update
NOTE: 20260830: Added by Front-Desk (dleidert)
NOTE: 20260830: Follow DSA-6475-1 (dleidert/front-desk)
--
-swift
- NOTE: 20260726: Added by Front-Desk (utkarsh)
- NOTE: 20260726: CVE-2026-50221: proxy gatekeeper does not strip the
- NOTE: 20260726: X-Container-Host/X-Delete-At-Host update headers from
- NOTE: 20260726: clients (SSRF). Already in ela-needed for buster, so it
- NOTE: 20260726: makes sense to fix bookworm+bullseye alongside it;
- NOTE: 20260726: trixie (2.35.1) is affected too and should be fixed.
- NOTE: 20260726: Fix is 3 regexes in gatekeeper.py and applies cleanly
- NOTE: 20260726: to bookworm 2.30.1 and bullseye 2.26.0. (utkarsh/front-desk)
- NOTE: 20260819: Maintainer uploaded 2.30.1-0+deb12u2 fixing CVE-2026-50221
- NOTE: 20260819: and CVE-2026-71190. (charles)
---
tesseract
NOTE: 20260919: Added by Front-Desk (Beuc)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/04d3f2996c52db724b374cfb8ff6af473b39e1b4...65e6431a4ecd8e7ace0572a763e56a6fbfa20ddb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/04d3f2996c52db724b374cfb8ff6af473b39e1b4...65e6431a4ecd8e7ace0572a763e56a6fbfa20ddb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
