Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
107cf7ad by Moritz Muehlenhoff at 2026-09-29T11:35:42+02:00
jetty updates
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -29820,10 +29820,9 @@ CVE-2026-19614 (The API is prone to XML external
entity (XXE) injection. By defa
NOTE:
https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614
TODO: check details as reference not accessible
CVE-2026-19203 (A client may issue specially crafted HTTP/1.1 chunked requests
to a Je ...)
- - jetty12 <undetermined>
- - jetty9 <undetermined>
+ - jetty12 12.0.39-1
+ - jetty9 <unfixed>
NOTE:
https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h
- TODO: check, GHSA reference not yet public
CVE-2026-18851 (Missing authorization in Ivanti Endpoint Manager Mobile before
version ...)
NOT-FOR-US: Ivanti
CVE-2026-18021 (The The Beaver Builder Page Builder \u2013 Drag and Drop
Website Build ...)
@@ -29857,10 +29856,9 @@ CVE-2026-12646 (A Missing Authorization vulnerability
in Ivanti Neurons for ITSM
CVE-2026-12645 (A Missing Authorization vulnerability in Ivanti Neurons for
ITSM befor ...)
NOT-FOR-US: Ivanti
CVE-2026-12611 (A client may issue HTTP/2 requests to a Jetty server that
result in bl ...)
- - jetty12 <undetermined>
- - jetty9 <undetermined>
+ - jetty12 12.0.39-1
+ - jetty9 <unfixed>
NOTE:
https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
- TODO: check, GHSA reference not yet public
CVE-2026-12387 (Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel
Driver, Arm ...)
NOT-FOR-US: Arm
CVE-2026-12285 (Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel
Driver, Arm ...)
@@ -30368,10 +30366,9 @@ CVE-2026-19843 (A flaw was found in 389-ds-base. The
Cockpit 389 Console's LDAP
- 389-ds-base <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2515965
CVE-2026-19204 (A client may send a WebSocket frame with an unknown opcode and
a very ...)
- - jetty12 <undetermined>
- - jetty9 <undetermined>
+ - jetty12 12.0.39-1
+ - jetty9 <not-affected> (Only affects 10.x and later)
NOTE:
https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
- TODO: check, GHSA reference not yet public
CVE-2026-18922 (A flaw was found in 389 Directory Server. During SASL PLAIN
authentica ...)
- 389-ds-base <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2511388
@@ -92877,11 +92874,10 @@ CVE-2025-12011 (A denial-of-service issue
existsin5370/5570controllers. This vul
CVE-2025-11698 (A denial-of-service issue exists
in5380/5480/5580controllersbootfirmwa ...)
NOT-FOR-US: Rockwell Automation
CVE-2024-7708 (For requests that have a body, but reading the body may end up
in read ...)
- - jetty12 <undetermined>
- - jetty9 <undetermined>
+ - jetty12 <not-affected> (Fixed before initial upload of 12 to the
archive)
+ - jetty9 <not-affected> (Only affects 10.x and later)
NOTE:
https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc
NOTE: https://github.com/jetty/jetty.project/pull/12156
- TODO: check
CVE-2026-15719 (We are aware that exploit code for this is public however we
are not a ...)
{DSA-6418-1 DSA-6394-1 DLA-4727-1 DLA-4695-1}
- firefox 152.0.6-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/107cf7ad44313f523be861da677cd2eaa1150305
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/107cf7ad44313f523be861da677cd2eaa1150305
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
