Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f84c744c by Salvatore Bonaccorso at 2026-10-01T22:24:04+02:00
Add three new python-tornado issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -402,11 +402,17 @@ CVE-2026-103265 (Fleet versions before 4.89.0 fail to
properly filter MDM comman
CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass
vulnerab ...)
NOT-FOR-US: Fleet
CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability
in Static ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
+ NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
(v6.5.9)
CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory
accumulation ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
+ NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
(v6.5.9)
CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query
string fields ...)
- TODO: check
+ - python-tornado <unfixed>
+ NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
+ NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
(v6.5.9)
CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain
an approva ...)
NOT-FOR-US: n8n
CVE-2026-103259 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a
session ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f84c744c403dc000b4c39326ac6d7c65a70d41fb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f84c744c403dc000b4c39326ac6d7c65a70d41fb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
