Daniel Leidert pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d03b9910 by Daniel Leidert at 2026-10-02T08:30:52+02:00
lts: mark CVE-2026-54275/python-aiohttp as not affecting Bookworm
- - - - -
a4308cd4 by Daniel Leidert at 2026-10-02T08:30:53+02:00
lts: mark CVE-2026-69244/python-aiohttp as not affecting Bookworm
- - - - -
222695b4 by Daniel Leidert at 2026-10-02T08:31:31+02:00
Reserve DLA-4813-1 for open-iscsi
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -78020,6 +78020,8 @@ CVE-2026-69245 (Guzzle is an extensible PHP HTTP
client. Prior to 7.15.2 and 8.0
CVE-2026-69244 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
- python-aiohttp 3.14.3-1 (bug #1143597)
[trixie] - python-aiohttp <no-dsa> (Minor issue)
+ [bookworm] - python-aiohttp <not-affected> (Vulnerable code introduced
later)
+ [bullseye] - python-aiohttp <not-affected> (Vulnerable code introduced
later)
NOTE:
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273
NOTE: https://github.com/aio-libs/aiohttp/pull/13223
NOTE: Fixed by:
https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
(v3.14.3)
@@ -117265,6 +117267,8 @@ CVE-2026-54276 (AIOHTTP is an asynchronous HTTP
client/server framework for asyn
CVE-2026-54275 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
- python-aiohttp 3.14.1-1
[trixie] - python-aiohttp <no-dsa> (Minor issue)
+ [bookworm] - python-aiohttp <not-affected> (Vulnerable code not present)
+ [bullseye] - python-aiohttp <not-affected> (Vulnerable code not present)
NOTE:
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5
NOTE: Fixed by:
https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
(v3.14.1)
CVE-2026-54274 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[02 Oct 2026] DLA-4813-1 open-iscsi - security update
+ {CVE-2026-18724 CVE-2026-18725 CVE-2026-18726 CVE-2026-18727
CVE-2026-18728 CVE-2026-44943 CVE-2026-44944}
+ [bookworm] - open-iscsi 2.1.8-1+deb12u1
[02 Oct 2026] DLA-4812-1 libio-compress-perl - security update
{CVE-2025-15649 CVE-2026-48959 CVE-2026-48962}
[bookworm] - libio-compress-perl 2.204-1+deb12u1
=====================================
data/dla-needed.txt
=====================================
@@ -500,9 +500,6 @@ ntfs-3g
NOTE: 20260716: Added by Front-Desk (Beuc)
NOTE: 20260716: Follow DSA-6389-1 (9 CVEs) (Beuc/front-desk)
--
-open-iscsi (dleidert)
- NOTE: 20260802: Added by Front-Desk (ta)
---
openexr
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260713: Also add for bookworm (Beuc/front-desk)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b4a2f7d027800c05216f2d90a595348643382856...222695b42bd0c5d98a3f9507364ea2b15cb98bf5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b4a2f7d027800c05216f2d90a595348643382856...222695b42bd0c5d98a3f9507364ea2b15cb98bf5
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
