Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0e2593bb by Salvatore Bonaccorso at 2026-10-02T17:21:48+02:00
Add Debian bug reference for modsecurity-apache issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1346,17 +1346,17 @@ CVE-2023-54402 (iDocView contains a server-side request
forgery vulnerability in
NOT-FOR-US: iDocView
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses
multipart filename rules]
- modsecurity <unfixed> (bug #1149651)
- - modsecurity-apache <unfixed>
+ - modsecurity-apache <unfixed> (bug #1149714)
NOTE: https://github.com/advisories/GHSA-5pww-8rfg-9crf
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-4j47-8qcr-jf59: t:base64DecodeExt does not decode - and _,
bypassing rules on URL-safe encoded payloads]
- modsecurity <unfixed> (bug #1149651)
- - modsecurity-apache <unfixed>
+ - modsecurity-apache <unfixed> (bug #1149714)
NOTE: https://github.com/advisories/GHSA-4j47-8qcr-jf59
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character
after a comment terminator, bypassing rules]
- modsecurity <unfixed> (bug #1149651)
- - modsecurity-apache <unfixed>
+ - modsecurity-apache <unfixed> (bug #1149714)
NOTE: https://github.com/advisories/GHSA-qrch-pjfr-9g47
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling:
match-limit fail-open and invalid-pattern crash]
@@ -1373,12 +1373,12 @@ CVE-2026-73857 [GHSA-jx3r-phvx-2jmj: XML request body
processor dereferences an
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-61813 [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification
setting when fetching over HTTPS]
- modsecurity <unfixed> (bug #1149651)
- - modsecurity-apache <unfixed>
+ - modsecurity-apache <unfixed> (bug #1149714)
NOTE: https://github.com/advisories/GHSA-2vqc-36qp-ccmw
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-61812 [GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to
evasion]
- modsecurity <unfixed> (bug #1149651)
- - modsecurity-apache <unfixed>
+ - modsecurity-apache <unfixed> (bug #1149714)
NOTE: https://github.com/advisories/GHSA-cxqf-vgrr-xxrv
NOTE:
https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-97347 (The Post Views Stats Counter plugin for WordPress is
vulnerable to Sto ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0e2593bbd620a28d91da43dfceec6a705d3048ac
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0e2593bbd620a28d91da43dfceec6a705d3048ac
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
