Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c03c1487 by Salvatore Bonaccorso at 2026-10-27T20:42:14+01:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1140,56 +1140,56 @@ CVE-2026-65686
CVE-2026-65685
REJECTED
CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and
ES512) JWS s ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
NOTE: https://cna.erlef.org/cves/CVE-2026-65632.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65632
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
(1.0.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf
(1.11.13)
CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an
unauthenti ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-3m45-vrpj-xmrq
NOTE: https://cna.erlef.org/cves/CVE-2026-65631.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65631
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/d19e1ba68d88c68d29aa942be2573a22dbafca1f
(1.7.7)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/bfd336c0062bff93e65d08c22361897e96afd956
(1.11.13)
CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad
jose allows ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp
NOTE: https://cna.erlef.org/cves/CVE-2026-65630.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65630
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/8e532095de114ef4bf88a9ec5d651fa251a972b3
(1.10.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79
(1.11.13)
CVE-2026-65629 (Use of Password Hash With Insufficient Computational Effort in
the jos ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc
NOTE: https://cna.erlef.org/cves/CVE-2026-65629.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65629
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9
(1.10.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0
(1.11.13)
CVE-2026-65628 (jose_jwk:shared_secret/2 (exposed in Elixir as
JOSE.JWK.shared_secret/ ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
NOTE: https://cna.erlef.org/cves/CVE-2026-65628.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65628
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/7b80b9f55b9898e1a6901ce136061b241b021d7c
(1.5.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a
(1.11.13)
CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
NOTE: https://cna.erlef.org/cves/CVE-2026-65627.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65627
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
(1.0.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad
(1.11.13)
CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the
jose_jwa_pkcs1 modu ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-vwvr-f994-6j9j
NOTE: https://cna.erlef.org/cves/CVE-2026-65626.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65626
NOTE: Introduced with:
https://github.com/potatosalad/erlang-jose/commit/853c5d4c4c0bd2a7ecb055b237f4284184e176c8
(1.3.0)
NOTE: Fixed by:
https://github.com/potatosalad/erlang-jose/commit/0eac8cef9aaa48fb6846f4e47a0002dc4a73966d
(1.11.13)
CVE-2026-65625 (The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the
number of ...)
- - erlang-jose <unfixed>
+ - erlang-jose <unfixed> (bug #1152299)
NOTE:
https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6
NOTE: https://cna.erlef.org/cves/CVE-2026-65625.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65625
@@ -1325,16 +1325,16 @@ CVE-2026-116806 (OpenPanel before 3.0.0 contains a
missing authorization vulnera
CVE-2026-116805 (OpenPanel before 3.0.0 contains an information disclosure
vulnerabilit ...)
NOT-FOR-US: OpenPanel
CVE-2026-116804 (DOMPurify from 3.4.4 before 3.4.17 contains a
SAFE_FOR_TEMPLATES bypas ...)
- - node-dompurify <unfixed>
+ - node-dompurify <unfixed> (bug #1152298)
[trixie] - node-dompurify <not-affected> (Vulnerable code introduced in
3.4.4 upstream)
[bookworm] - node-dompurify <not-affected> (Vulnerable code introduced
in 3.4.4 upstream)
NOTE:
https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
CVE-2026-116803 (DOMPurify before 3.4.17 contains a cross-site scripting
vulnerability ...)
- - node-dompurify <unfixed>
+ - node-dompurify <unfixed> (bug #1152298)
NOTE:
https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
NOTE: Issue exists because of an incomplete fix for CVE-2026-109344 /
GHSA-p98j-92pf-mc4p
CVE-2026-116802 (DOMPurify before 3.4.17 contains a cross-site scripting
vulnerability ...)
- - node-dompurify <unfixed>
+ - node-dompurify <unfixed> (bug #1152298)
NOTE:
https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
CVE-2026-116801 (Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6
does not v ...)
NOT-FOR-US: Parse Server
@@ -1447,14 +1447,14 @@ CVE-2026-116579 (Autobahn Python is a WebSocket and
WAMP implementation for Pyth
NOTE: https://github.com/crossbario/autobahn-python/pull/1987
NOTE: Fixed by:
https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1
(v26_10_1)
CVE-2026-116578 (Tornado is a Python web framework and asynchronous networking
library. ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1152300)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
NOTE: https://github.com/tornadoweb/tornado/pull/3786
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
(v6.6.0b1)
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
(v6.6.0rc1)
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
(v6.6.0rc1)
CVE-2026-116577 (Tornado is a Python web framework and asynchronous networking
library. ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1152300)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c
NOTE: https://github.com/tornadoweb/tornado/pull/3765
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9
(v6.6.0b1)
@@ -1493,7 +1493,7 @@ CVE-2026-116478 (A vulnerability was detected in
a2aproject a2a-go up to 2.4.0.
CVE-2026-116477 (A security vulnerability has been detected in a2aproject
a2a-dotnet up ...)
TODO: check
CVE-2026-115927 (Tornado is a Python web framework and asynchronous networking
library. ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1152300)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985
NOTE: https://github.com/tornadoweb/tornado/pull/3773
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8
(v6.6.0b1)
@@ -2231,19 +2231,19 @@ CVE-2026-116544 (Open5GS 2.6.1 through 2.8.0 contains
an out-of-bounds read vuln
CVE-2026-116543 (Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds
write vulner ...)
- open5gs <itp> (bug #1094791)
CVE-2026-116542 (Netty netty-tcnative before 2.0.84.Final contains an SNI
hostname spoo ...)
- - netty-tcnative <unfixed>
+ - netty-tcnative <unfixed> (bug #1152301)
NOTE:
https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf
NOTE: Fixed by:
https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38
(netty-tcnative-parent-2.0.84.Final)
CVE-2026-116541 (Netty netty-tcnative before 2.0.84.Final contains a denial of
service ...)
- - netty-tcnative <unfixed>
+ - netty-tcnative <unfixed> (bug #1152301)
NOTE:
https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489
NOTE: Fixed by:
https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b
(netty-tcnative-parent-2.0.84.Final)
CVE-2026-116540 (netty-tcnative 2.0.66.Final before 2.0.84.Final built against
OpenSSL ...)
- - netty-tcnative <unfixed>
+ - netty-tcnative <unfixed> (bug #1152301)
NOTE:
https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
NOTE: Fixed by:
https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118
(netty-tcnative-parent-2.0.84.Final)
CVE-2026-116539 (Netty netty-tcnative before 2.0.84.Final contains a heap
buffer overfl ...)
- - netty-tcnative <unfixed>
+ - netty-tcnative <unfixed> (bug #1152301)
NOTE:
https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh
NOTE: Fixed by:
https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8
(netty-tcnative-parent-2.0.84.Final)
CVE-2026-116538 (HtmlSanitizer before 9.2.1039 and 10.0 prereleases before
10.0.1037-be ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c03c1487b645000b7d02cd0b28c5ead6414e0f81
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c03c1487b645000b7d02cd0b28c5ead6414e0f81
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
