Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2824775b by Salvatore Bonaccorso at 2026-09-29T21:30:43+02:00
CVEs assigned for urllib3 issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2,12 +2,6 @@ CVE-2026-98164 (In the Linux kernel, the following
vulnerability has been resolv
TODO: check
CVE-2026-97711 (Serialize JavaScript serializes JavaScript values to a
superset of JSO ...)
TODO: check
-CVE-2026-97689 (urllib3 is an HTTP client library for Python. From 1.10.3
until 2.8.0, ...)
- TODO: check
-CVE-2026-97688 (urllib3 is an HTTP client library for Python. From 2.6.2 until
2.8.0, ...)
- TODO: check
-CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0
until 2.8.0, ...)
- TODO: check
CVE-2026-97395 (Apache Polaris allows an authenticated principal with
permission to cr ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted
Directory\uff08Path ...)
@@ -10337,17 +10331,22 @@ CVE-2026-93012 (Email::Sender::Transport::Sendmail
versions before 2.602 for Per
- libemail-sender-perl <not-affected> (Only affects Email::Sender on
Windows)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43733017/
NOTE: Fixed by:
https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c
(2.602)
-CVE-2026-XXXX [GHSA-8988-9cw3-xx77: HTTPS proxy TLS configuration may be
ignored or overridden]
+CVE-2026-97687 [GHSA-8988-9cw3-xx77: HTTPS proxy TLS configuration may be
ignored or overridden]
- python-urllib3 2.8.0-1
NOTE:
https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
-CVE-2026-XXXX [GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked()
buffers an unbounded chunk-size line into memory]
+ NOTE: https://github.com/urllib3/urllib3/pull/5093
+ NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465
(2.8.0)
+ NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3
(2.8.0)
+CVE-2026-97689 [GHSA-vxq7-64xx-v4gw: HTTPResponse.stream()/read_chunked()
buffers an unbounded chunk-size line into memory]
- python-urllib3 2.8.0-1
NOTE:
https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw
-CVE-2026-XXXX [GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming can enter an
infinite loop]
+ NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed
(2.8.0)
+CVE-2026-97688 [GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming can enter an
infinite loop]
- python-urllib3 2.8.0-1
[trixie] - python-urllib3 <not-affected> (Vulnerable code not present,
introduced in 2.6.2)
[bookworm] - python-urllib3 <not-affected> (Vulnerable code not
present, introduced in 2.6.2)
NOTE:
https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g
+ NOTE: Fixed by:
https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f
(2.8.0)
CVE-2026-94218 (A flaw was found in the authentication session management of
Keycloak, ...)
- keycloak <itp> (bug #1088287)
CVE-2026-94217 (A flaw was found in the User-Managed Access (UMA)
implementation of Ke ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2824775b6525fa44783b35e892cbe558c48f2388
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2824775b6525fa44783b35e892cbe558c48f2388
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
