Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: a44bb214 by Salvatore Bonaccorso at 2026-10-03T21:31:34+02:00 Add new bouncycastle issues - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,5 +1,7 @@ CVE-2026-97873 (In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy P ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9097873 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1 (r1rv86) CVE-2026-96451 (Authorization Bypass Through User-Controlled Key vulnerability in Ulti ...) NOT-FOR-US: WordPress plugin or theme CVE-2026-92767 (The Twenty20 Image Before-After plugin for WordPress is vulnerable to ...) @@ -7,23 +9,42 @@ CVE-2026-92767 (The Twenty20 Image Before-After plugin for WordPress is vulnerab CVE-2026-92084 (The The Beaver Builder Page Builder \u2013 Drag and Drop Website Build ...) NOT-FOR-US: WordPress plugin CVE-2026-85515 (In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted m ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9085515 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/ab7a235d1c20e3da28ce77167a96b5c14025efa7 (r1rv86) CVE-2026-71892 (In Bouncy Castle for Java before 1.86, the opt-in key-size validation ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071892 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/be0a7d925c818ef2f338bcec55178b9b6336dfc3 (r1rv86) CVE-2026-71891 (In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb (v1rv86) + TODO: check, maybe only introduced in 1.85? CVE-2026-71890 (In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071890 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/7e8bb10eb90baddf3f10b8679f627462b9522d24 (v1rv86) CVE-2026-71889 (In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathRev ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071889 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85 (r1rv86) CVE-2026-71888 (In Bouncy Castle for Java before 1.86, the streaming CMS Authenticated ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95 (r1rv86) CVE-2026-71887 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP API acce ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6 (r1rv86) CVE-2026-71886 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP certific ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071886 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/f0d5c8535aeff3f34b7b6b6289ee78c2ea36a3fb (r1rv86) CVE-2026-71885 (In Bouncy Castle for Java before 1.86, the Messaging Layer Security (M ...) - TODO: check + - bouncycastle 1.86-1 + NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071885 + NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/77632a57edf350a7b5751fca1a5052daffa8dab2 (v1rv86) CVE-2026-71883 (In Bouncy Castle for Java LTS before 2.73.13, the one-shot native pack ...) TODO: check CVE-2026-18040 (In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a44bb214f2fe68dd3ec240137e21dfa7f4488a57 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a44bb214f2fe68dd3ec240137e21dfa7f4488a57 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
