Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7e0236cc by Salvatore Bonaccorso at 2026-10-29T21:44:37+01:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1070,43 +1070,43 @@ CVE-2026-118660 (Happy DOM is a JavaScript
implementation of a web browser witho
CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser
without its ...)
TODO: check
CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1,
Context.Scheme ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
NOTE: Fixed by:
https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181
(v4.15.2)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df
(v5.1.1)
CVE-2026-118657 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0,
Context.Scheme ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
NOTE: Fixed by:
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
(v4.16.0)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
CVE-2026-118656 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0,
sanitizeURI che ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48
NOTE: Fixed by:
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
(v4.16.0)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0,
middleware.Stat ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
NOTE: https://github.com/labstack/echo/issues/2599
NOTE: https://github.com/labstack/echo/pull/3006
NOTE: Fixed by;
https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
(v4.15.3)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
(v5.2.0)
CVE-2026-118654 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's
static f ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr
NOTE: Fixed by:
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
(v4.16.0)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
CVE-2026-118653 (Echo is a Go web framework. From 4.0.0 until 5.1.0,
Context.RealIP fal ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq
NOTE: Fixed by:
https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2
(v5.1.0)
CVE-2026-118652 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0,
Context.JSONP a ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g
NOTE: Fixed by:
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
(v4.16.0)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
CVE-2026-118651 (Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy
middlewa ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a
globally moun ...)
@@ -1136,7 +1136,7 @@ CVE-2026-118537 (A vulnerability was found in a2ui up to
0.10.4. This vulnerabil
CVE-2026-118426 (In affected versions of Octopus Server with the LDAP
authentication pr ...)
NOT-FOR-US: Octopus Deploy
CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's
MethodOv ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4
NOTE: Fixed by:
https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
(v4.16.0)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
(v5.4.0)
@@ -1545,7 +1545,7 @@ CVE-2026-118265 (Echo is a Go web framework. From 5.0.0
until 5.4.1, Echo v5's E
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg
NOTE: Fixed by:
https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae
(v5.4.1)
CVE-2026-118264 (Echo is a Go web framework. From 4.0.0 until 4.16.1 and
5.4.1, Echo's ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8
NOTE: Fixed by:
https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
(v4.16.1)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
(v5.4.1)
@@ -1555,16 +1555,16 @@ CVE-2026-118263 (Echo is a Go web framework. From 5.0.0
until 5.4.1, Echo v5's B
NOTE: https://github.com/labstack/echo/pull/3105
NOTE: Fixed by:
https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
(v5.4.1)
CVE-2026-118262 (Echo is a Go web framework. From 4.15.0 until 4.16.1 and
5.4.1, Echo's ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5
NOTE: Fixed by:
https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
(v4.16.1)
NOTE: Fixed by:
https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
(v5.4.1)
CVE-2026-118261 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo
v4's opt-in ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc
NOTE: Fixed by:
https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
(v4.16.1)
CVE-2026-118260 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo
v4's opt-in ...)
- - golang-github-labstack-echo <unfixed>
+ - golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE:
https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv
NOTE: Fixed by:
https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
(v4.16.1)
CVE-2026-118259 (opentelemetry-java is the Java implementation of the
OpenTelemetry API ...)
@@ -2187,41 +2187,41 @@ CVE-2026-100105 (A user with permission to edit contact
points but not their pro
CVE-2025-30414 (Local privilege escalation due to improper authentication. The
followi ...)
NOT-FOR-US: Acronis
CVE-2026-117501 (HTTP::Body versions before 1.24_01 for Perl allow memory
exhaustion vi ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711939/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556
CVE-2026-117500 (HTTP::Body versions before 1.24_01 for Perl allow CPU
exhaustion via r ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711935/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694
CVE-2026-116531 (HTTP::Body versions before 1.23_01 for Perl lose track of
chunk bounda ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711932/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a
(v1.24)
CVE-2026-116285 (HTTP::Body versions before 1.23_01 for Perl allow CPU
exhaustion via q ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711941/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574
(v1.24)
CVE-2026-116135 (HTTP::Body versions before 1.23_01 for Perl drop mixed-case
percent es ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711937/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d
(v1.24)
CVE-2026-116134 (HTTP::Body versions before 1.23_01 for Perl allow memory
exhaustion vi ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711947/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5
(v1.24)
CVE-2026-116133 (HTTP::Body versions before 1.23_01 for Perl allow CPU
exhaustion via q ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711943/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79
(v1.24)
CVE-2026-116132 (HTTP::Body versions before 1.23_01 for Perl leave the
temporary file o ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711945/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=84004
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3
(v1.24)
CVE-2026-116131 (HTTP::Body versions before 1.23_01 for Perl allow memory and
temporary ...)
- - libhttp-body-perl <unfixed>
+ - libhttp-body-perl <unfixed> (bug #1152485)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711949/
NOTE: Fixed by:
https://github.com/libwww-perl/HTTP-Body/commit/47beca524a3062eacfd646664576f005fb4be19b
(v1.24)
CVE-2026-XXXX [Memory corruption when an application cancels its lookups after
a connection failure]
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e0236cc3f69ce191fa5b7a8401df7631bc27eeb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e0236cc3f69ce191fa5b7a8401df7631bc27eeb
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
