[Git][security-tracker-team/security-tracker][helmutg/web-readonly] 28 commits: web tracker: refactor service class hierarchy
Helmut Grohne (@helmutg)
helmutg at debian.org
Wed Aug 12 17:24:14 BST 2026
Helmut Grohne pushed to branch helmutg/web-readonly at Debian Security Tracker / security-tracker
Commits:
69566480 by Helmut Grohne at 2026-08-11T13:27:25+02:00
web tracker: refactor service class hierarchy
The hierarchy was weird. The lowest level is WebServiceBase and mainly
is a URL router. From there we go to WebServiceHTTP (and earlier also
WebService) implementing the network facing side. Then TrackerService
inherits from one of the services. Until WebService was removed, the
class hierarchy was dependent on command line arguments. This is a
coding smell of using a wrong pattern.
The ability to swap out the base class of TrackerService hints at it not
integrating tightly with its direct base class. Indeed, the
TrackerService doesn't need to know anything about how requests arrive
at the url router or are delivered from there. We can reparent it to
WebServiceBase with little loss. What is lost in the process is the
ability to actually service any requests.
The former base class WebServiceHTTP needs to reenter the picture
somehow. The WebServiceHTTP does not directly interface with
TrackerService as all of the interaction is handled via the
WebServiceBase URL router. Instead of inheriting from WebServiceBase,
WebServiceHTTP can be passed a WebServiceBase instance and redirect some
attribute lookups. In effect, we replace inheritance with composition.
To reflect this, I also rename WebServiceHTTP to WebServiceHTTPAdapter.
This results in the class hierarchy becoming static. Even if WebService
were not removed yet, TrackerService would only inherit from
WebServiceBase. Consequently, the caller of TrackerService now has to
separately instantiate WebServiceHTTPAdapter and in doing so can choose
the adapter without changing the class hierarchy.
The real goal behind this refactoring is the ability to provide more
adapter classes. Thus we can experiment with another adapter supporting
HTTP/1.1 without interfering with the existing deployment. In
particular, it seems possible to adapt the service to WSGI which opens a
door to a lot of deployment strategies.
- - - - -
8579d35d by Guilhem Moulin at 2026-08-12T12:22:13+02:00
LTS: claim roundcube in dla-needed.txt
- - - - -
952dee45 by Emilio Pozuelo Monfort at 2026-08-12T10:35:56+00:00
Merge branch 'helmutg/web-adapter' into 'master'
web tracker: refactor service class hierarchy
See merge request security-tracker-team/security-tracker!317
- - - - -
749953e4 by Moritz Muehlenhoff at 2026-08-12T12:46:46+02:00
new gh issues
- - - - -
dce10923 by Moritz Muehlenhoff at 2026-08-12T12:54:30+02:00
new mongoose issues
- - - - -
a3a4ae27 by Moritz Muehlenhoff at 2026-08-12T13:05:14+02:00
NFUs
- - - - -
2a34e31f by Moritz Muehlenhoff at 2026-08-12T13:35:47+02:00
NFUs
- - - - -
f6db50f5 by Moritz Muehlenhoff at 2026-08-12T13:53:28+02:00
NFUs
- - - - -
41e1d556 by Moritz Muehlenhoff at 2026-08-12T14:52:25+02:00
new iperf3 issues
- - - - -
8ca688d3 by Salvatore Bonaccorso at 2026-08-12T15:01:49+02:00
Track fixed version for glib2.0 via unstable
- - - - -
65932bfe by Salvatore Bonaccorso at 2026-08-12T15:11:13+02:00
Track fixed version for designate issues fixed via unstable
- - - - -
7847a427 by Salvatore Bonaccorso at 2026-08-12T15:44:25+02:00
Add references for CVE-2026-53361
- - - - -
cadec700 by Guilhem Moulin at 2026-08-12T15:50:03+02:00
LTS: claim libdbi-perl and libnet-dns-perl in dla-needed.txt
- - - - -
a198561c by Yadd at 2026-08-12T15:52:05+02:00
Reserve DLA-4734-1 for lemonldap-ng
- - - - -
a5a4c3d5 by Moritz Mühlenhoff at 2026-08-12T15:59:36+02:00
neovim spu
- - - - -
f8dcdff3 by Moritz Muehlenhoff at 2026-08-12T16:04:01+02:00
NFUs
- - - - -
f259abc7 by Moritz Muehlenhoff at 2026-08-12T16:51:26+02:00
new undertow issues
- - - - -
e28bd191 by Moritz Muehlenhoff at 2026-08-12T17:08:23+02:00
new libvirt issues
- - - - -
762a0973 by Moritz Muehlenhoff at 2026-08-12T17:09:45+02:00
janet is in the archive now
- - - - -
b734641e by Moritz Muehlenhoff at 2026-08-12T17:10:44+02:00
new isc-dhcp issue
- - - - -
66b726a7 by Moritz Muehlenhoff at 2026-08-12T17:17:53+02:00
new shim issue
- - - - -
97eb13f4 by Moritz Muehlenhoff at 2026-08-12T17:37:02+02:00
NFUs
- - - - -
2736c70c by Salvatore Bonaccorso at 2026-08-12T17:46:30+02:00
Add three new nltk issues
Note that the GHSA reference three differnt CVEs which got though
rejected in favour of the now used. The complete CVE enties do not exist
yet.
- - - - -
940c0501 by Salvatore Bonaccorso at 2026-08-12T17:53:53+02:00
Update status for CVE-2026-63622/libvirt
- - - - -
06d6a627 by Salvatore Bonaccorso at 2026-08-12T17:56:37+02:00
Update status for CVE-2026-63623/libvirt
- - - - -
81de3d6d by Salvatore Bonaccorso at 2026-08-12T18:12:50+02:00
Add two more freerdp3 issues
Note they are duplicate but probably the Github assigned ones are the
one which should be kept. The other are assigned by the VulnCheck CNA.
- - - - -
85e765c4 by Helmut Grohne at 2026-08-12T18:22:22+02:00
security_db.py: support opening the database read-only
Most applications using the database know in advance whether they intend
to modify it. As a defensive mechanism, we can convey this intention and
make stuff fail when the intention is not met.
- - - - -
1a274edc by Helmut Grohne at 2026-08-12T18:23:26+02:00
tracker_service.py: open the security database read-only
The web service never modifies the database. All updates are performed
via other scripts. Convey this to the database class to defend against
unintended modification.
As a side effect, this slightly reduces the cost of creating the
connection, which may become relevant if we more frequently open
connections for scaling load. It also removes a possible race condition
if (read-only) connections were created concurrently.
Suggested-by: Enrico Zini <enrico at enricozini.org>
- - - - -
7 changed files:
- bin/tracker_service.py
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
- data/next-point-update.txt
- lib/python/security_db.py
- lib/python/web_support.py
Changes:
=====================================
bin/tracker_service.py
=====================================
@@ -98,7 +98,8 @@ class BugFilter:
"""Returns True for postponedissues if filtered."""
return no_dsa_reason == 'postponed' and not self.params['nopostponed']
-class TrackerService(WebServiceHTTP):
+
+class TrackerService(WebServiceBase):
nvd_text = P('''If a "**" is included, the urgency field was automatically
assigned by the NVD (National Vulnerability Database). Note that this
rating is automatically derived from a set of known factors about the
@@ -107,9 +108,9 @@ class TrackerService(WebServiceHTTP):
determining the values of these factors, but the rating itself comes
from a fully automated formula.''')
- def __init__(self, socket_name, db_name):
- WebServiceHTTP.__init__(self, socket_name)
- self.db = security_db.DB(db_name)
+ def __init__(self, db_name):
+ WebServiceBase.__init__(self)
+ self.db = security_db.DB(db_name, readonly=True)
self.stable_releases = config.get_supported_releases()
self.stable_releases.remove(config.get_release_codename('testing'))
@@ -1526,4 +1527,4 @@ Debian bug number.'''),
return SPAN(contents, _class="dangerous")
if __name__ == "__main__":
- TrackerService(socket_name, db_name).run()
+ WebServiceHTTPAdapter(TrackerService(db_name), socket_name).run()
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,72 @@
+CVE-2026-12061
+ - nltk <unfixed>
+ NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-fg7f-2386-8897
+CVE-2026-12072
+ - nltk <unfixed>
+ NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-6hm5-jgcp-p838
+CVE-2026-12074
+ - nltk <unfixed>
+ NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-xh95-f55m-82fw
+CVE-2026-68868
+ NOT-FOR-US: Apache Airflow provider
+CVE-2026-52073 [ppp_handle_ipcp attacker-controlled IPCP length -- OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52054 [find_opt zero-length PPP option -- infinite loop]
+ - mongoose 7.22+ds-1
+CVE-2026-52068 [rx_ndp_na NDP NA missing option length check -- OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52070 [rx_ndp_ns ICMPv6 NS minimum length insufficient -- OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52053 [rx_ip6 IPv6 extension header OOB read; 16-bit len wrap]
+ - mongoose 7.22+ds-1
+CVE-2026-52062 [NDP RA allows any value for MTU]
+ - mongoose 7.22+ds-1
+CVE-2026-52047 [w5100_rx wraparound RX path copies n instead of r bytes]
+ - mongoose 7.22+ds-1
+CVE-2026-52076 [cyw_spi_tx SPI alignment padding indexes uint32_t* buffer with byte offset]
+ - mongoose 7.22+ds-1
+CVE-2026-52067 [rx_ip truncated DHCP options size_t underflow OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52069 [rx_dhcp_client 32-bit overflow in DHCP lease millisecond conversion]
+ - mongoose 7.22+ds-1
+CVE-2026-52078 [opendir() stack overflow via wcscat on MAX_PATH path]
+ - mongoose 7.22+ds-1
+CVE-2026-52079 [ENET_IRQHandler RX descriptor not re-owned on error -- RX ring stall]
+ - mongoose 7.22+ds-1
+CVE-2026-52064 [DNS transaction ID is sequential -- enables response injection]
+ - mongoose 7.22+ds-1
+CVE-2026-52048 [MQTT v5 properties bounds check uses relative offset against absolute position]
+ - mongoose 7.22+ds-1
+CVE-2026-52056 [skip_chunk off-by-one OOB read in chunked HTTP CRLF check]
+ - mongoose 7.22+ds-1
+CVE-2026-52050 [precompute_slide_window NULL deref on OOM / more_comps NULL deref after failed calloc / bi_initialize / alloc NULL deref on OOM]
+ - mongoose 7.22+ds-1
+CVE-2026-52072 [mg_tls_client_recv_hello size_t underflow in ext_len bounds check / mg_tls_client_recv_hello ext_len fixed-offset OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52051 [mg_tls_server_recv_hello session_id_len OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52065 [mg_tls_client_recv_hello key_share extension OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52071 [mg_tls_verify_cert_signature OOB read for short ECDSA integers]
+ - mongoose 7.22+ds-1
+CVE-2026-52052 [mg_tls_parse_cert_der pubkey BIT STRING length underflow -- OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52058 [mg_der_to_tlv long-form DER length OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52055 [mg_der_to_tlv long-form DER length OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52057 [mg_der_find_oid unbounded recursion on constructed DER tags]
+ - mongoose 7.22+ds-1
+CVE-2026-52061 [mg_tls_recv_cert certificate chain length unchecked -- OOB read]
+ - mongoose 7.22+ds-1
+CVE-2026-52075 [mg_random rand() fallback used for TLS secrets]
+ - mongoose 7.22+ds-1
+CVE-2026-52066 [TLS certificate notAfter validated against hardcoded 2025-01-01 string]
+ - mongoose 7.22+ds-1
+CVE-2026-52060 [TLS certificate notAfter validated against hardcoded 2025-01-01 string]
+ - mongoose 7.22+ds-1
+CVE-2026-52059 [RSA-PSS CertificateVerify checks only 0xbc trailer]
+ - mongoose 7.22+ds-1
CVE-2026-19566
- libnet-cidr-set-perl 0.23-1
NOTE: https://lists.security.metacpan.org/cve-announce/msg/42620063/
@@ -28,9 +97,18 @@ CVE-2026-73244 (kkFileView is a universal file online preview project based on S
CVE-2026-73243 (kkFileView is a universal file online preview project based on Spring ...)
NOT-FOR-US: kkFileView
CVE-2026-73242 (FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...)
- TODO: check
+ - freerdp3 3.30.0+dfsg-1
+ - freerdp2 <removed>
+ NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v
+ NOTE: https://github.com/FreeRDP/FreeRDP/pull/13065
+ NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc (3.30.0)
CVE-2026-73241 (FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...)
- TODO: check
+ - freerdp3 3.30.0+dfsg-1
+ - freerdp2 <removed>
+ NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6x
+ NOTE: https://github.com/FreeRDP/FreeRDP/pull/13065
+ NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695 (3.30.0)
+ NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/pull/13065
CVE-2026-73235 (FreeCAD is a free and open-source multiplatform 3D parametric modeler. ...)
- freecad <unfixed>
NOTE: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49
@@ -51,7 +129,7 @@ CVE-2026-73232 (ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf al
CVE-2026-73231 (Faker generates massive amounts of fake data in the browser and Node.j ...)
TODO: check
CVE-2026-73230 (Ente provides end-to-end encrypted cloud services and security tools. ...)
- TODO: check
+ NOT-FOR-US: Ente
CVE-2026-73229 (Django REST framework is a powerful and flexible toolkit for building ...)
- djangorestframework <unfixed>
NOTE: https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2
@@ -68,41 +146,41 @@ CVE-2026-73032 (PapersGPT for Zotero 0.6.1 contains a remote code execution vuln
CVE-2026-73031 (telegram-search contains a stored cross-site scripting vulnerability t ...)
NOT-FOR-US: telegram-search
CVE-2026-72526 (A flaw was found in the multicloud-integrations component. The Applica ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71845 (A flaw was found in insights-client. The setDefault() function logs th ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71475 (A flaw was found in insights-client. A compromised managed cluster, re ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71474 (A flaw was found in insights-client. When the application receives a n ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71468 (A flaw was found in acm-search-v2-api-rhel9. When the `getFederationCo ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71467 (A flaw was found in search-v2-api. The authentication middleware in th ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-71290 (Improper TLS hostname verification vulnerability in Apache HttpCompone ...)
TODO: check
CVE-2026-70398 (A flaw was found in multicloud-integrations, a component of Red Hat Ad ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-70339 (Access of resource using incompatible type ('type confusion') in Micro ...)
NOT-FOR-US: Microsoft
CVE-2026-6484 (In an UEFI, Lack of verified boot to certain FV may cause arbitrary co ...)
NOT-FOR-US: Insyde
CVE-2026-68067 (The login endpoint on the Mira cloud API accepts any format-valid stri ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-67568 (The distributed Mira Android APK v4.5.15.4 allows an attacker read/wri ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-67558 (The Mira Android companion app v4.5.15.4 identifies the paired Mira ho ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-66878 (A flaw was found in multicloud-operators-subscription. A privileged us ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-66875 (In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-66832 (When the Mira Android app opens in-app WebView content (e.g., shop red ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-66659 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-66340 (The Mira cloud authentication endpoints do not enforce per-account rat ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-66154 (An insufficient certificate validation in a privileged communication w ...)
NOT-FOR-US: SonicWall
CVE-2026-66150 (Improper Control of Generation of Code ('Code Injection') Vulnerabilit ...)
@@ -118,15 +196,15 @@ CVE-2026-66146 (Multiple Cross-Site Scripting (XSS) vulnerabilities were identif
CVE-2026-66145 (An unauthenticated remote code execution vulnerability was identified ...)
NOT-FOR-US: SonicWall
CVE-2026-66098 (The Mira hormone monitor device firmware accepts a 0x01 write from any ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-65655 (When OAuth authentication is enabled and browser-facing TLS terminates ...)
TODO: check
CVE-2026-64954 (Velociraptor allows scheduling new collections via VQL queries in note ...)
TODO: check
CVE-2026-64934 (The Mira cloud API accepts the firmware version reported by the compan ...)
- TODO: check
+ NOT-FOR-US: Mira
CVE-2026-64927 (A flaw was found in the multicloud-operators-channel component. This v ...)
- TODO: check
+ NOT-FOR-US: Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-63177 (Malcolm is a network traffic analysis tool suite. Prior to version 26. ...)
TODO: check
CVE-2026-63134 (Malcolm is a network traffic analysis tool suite. Prior to version 26. ...)
@@ -142,11 +220,11 @@ CVE-2026-48813 (Flawfinder is a a static analysis tool for finding vulnerabiliti
CVE-2026-48804 (python-socketio is a Python implementation of the Socket.IO realtime c ...)
TODO: check
CVE-2026-48765 (TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a lo ...)
- TODO: check
+ NOT-FOR-US: TypeBot
CVE-2026-48763 (TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a d ...)
- TODO: check
+ NOT-FOR-US: TypeBot
CVE-2026-48762 (TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI ...)
- TODO: check
+ NOT-FOR-US: TypeBot
CVE-2026-45618 (LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior t ...)
TODO: check
CVE-2026-29036 (cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved na ...)
@@ -772,9 +850,14 @@ CVE-2026-71362 (Adobe Commerce is affected by an Incorrect Authorization vulnera
CVE-2026-71331 (Integer overflow or wraparound in Microsoft Azure Attestation service ...)
NOT-FOR-US: Microsoft
CVE-2026-71218 (A flaw was found in iperf3. A remote unauthenticated attacker can expl ...)
- TODO: check
+ - iperf3 3.18-1
+ NOTE: https://github.com/esnet/iperf/commit/0128d0357b7e8916fe39e980e455729bc0e5fd4e (3.18)
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2463003
CVE-2026-71217 (A flaw was found in iperf3. A remote attacker can exploit this vulnera ...)
- TODO: check
+ - iperf3 <unfixed>
+ [trixie] - iperf3 <no-dsa> (Minor issue)
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460984
+ NOTE: https://github.com/esnet/iperf/commit/494dd377eca4689672becdf06a85158557db1586
CVE-2026-70355 (Improper neutralization of input during web page generation ('cross-si ...)
NOT-FOR-US: Microsoft
CVE-2026-70354 (Out-of-bounds write in .NET allows an unauthorized attacker to execute ...)
@@ -1622,17 +1705,17 @@ CVE-2026-53414 (Missing bounds check in the annotator function of Zoom Clients a
CVE-2026-53413 (Missing bounds check in the annotator function of Zoom Clients allows ...)
NOT-FOR-US: Zoom
CVE-2026-51584 (An issue in usememos v0.27.1 allows a remote attacker to achieve accou ...)
- TODO: check
+ NOT-FOR-US: usememos
CVE-2026-51583 (An issue in usememos through v0.30.0 allows a remote authenticated att ...)
- TODO: check
+ NOT-FOR-US: usememos
CVE-2026-50516 (Missing authentication for critical function in Microsoft Azure Kubern ...)
NOT-FOR-US: Microsoft
CVE-2026-50472 (Heap-based buffer overflow in Windows LUAFV allows an authorized attac ...)
NOT-FOR-US: Microsoft
CVE-2026-50237 (A Server-Side Request Forgery and supply chain flaw was found in the O ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift Container Platform
CVE-2026-50236 (An authenticated SSRF flaw was found in the OpenShift Console Dev Cons ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift Container Platform
CVE-2026-50064 (A vulnerability has been identified in Solid Edge SE2025 (All versions ...)
NOT-FOR-US: Siemens
CVE-2026-50063 (A vulnerability has been identified in Solid Edge SE2025 (All versions ...)
@@ -1866,21 +1949,21 @@ CVE-2026-20770 (Protection mechanism failure for some Cluster Management Toolkit
CVE-2026-20769 (Improper conditions check for the Intel(R) NPU Driver for all versions ...)
TODO: check
CVE-2026-20765 (Incorrect comparison for some Intel(R) TDX Guest software before versi ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20763 (Incorrect calculation for some Intel(R) TDX Guest software before vers ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20755 (Protection mechanism failure for some LLM Scaler software within Ring ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20752 (Improper authentication for some Intel(R) PROSet/Wireless WiFi Softwar ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20749 (Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software wit ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20747 (Improper conditions check for some Intel(R) PROSet/Wireless WiFi Softw ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20745 (Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software fo ...)
NOT-FOR-US: Intel
CVE-2026-20741 (Improper access control for some Intel(R) PROSet/Wireless WiFi Softwar ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20739 (Improper conditions check for some Intel(R) PROSet/Wireless WiFi Softw ...)
NOT-FOR-US: Intel
CVE-2026-20737 (Exposure of sensitive information to an unauthorized actor for some In ...)
@@ -1890,13 +1973,13 @@ CVE-2026-20734 (Improper initialization in some firmware for some Intel(R) Activ
CVE-2026-20731 (Improper buffer restrictions for the Intel(R) NPU Driver for all versi ...)
TODO: check
CVE-2026-20728 (Protection mechanism failure for some Intel Extension for TensorFlow s ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20727 (Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Softwa ...)
NOT-FOR-US: Intel
CVE-2026-20715 (Improper input validation in some firmware for some Intel(R) Active Ma ...)
TODO: check
CVE-2026-20712 (Incomplete cleanup in some UEFI firmware for some Intel(R) reference p ...)
- TODO: check
+ NOT-FOR-US: Intel
CVE-2026-20708 (Insertion of sensitive information into log file in the subsystem for ...)
TODO: check
CVE-2026-20705 (Insecure storage of sensitive information in the Intel(R) TDX module f ...)
@@ -1910,17 +1993,17 @@ CVE-2026-19546 (A flaw was found in DBI. This is a fix for a partial fix for CVE
CVE-2026-19539 (Authorization Bypass Through User-Controlled Key in the ticket managem ...)
TODO: check
CVE-2026-19519 (A flaw was found in claircore's RPM package scanner. Crafted RPM heade ...)
- TODO: check
+ NOT-FOR-US: claircore
CVE-2026-19434 (Cross-site Scripting in the finding renderer in maalfer Pentestify bef ...)
- TODO: check
+ NOT-FOR-US: Pentestify
CVE-2026-19418 (The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2 ...)
NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-19078 (A flaw was found in the oauth-server component. This open redirect vul ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift Container Platform 4
CVE-2026-18972 (An authenticated attacker can spoof another GUI user's identity by sen ...)
- TODO: check
+ NOT-FOR-US: Velociraptor
CVE-2026-18860 (Velociraptor allows multi-tenant deployments named "Orgs". By default ...)
- TODO: check
+ NOT-FOR-US: Velociraptor
CVE-2026-18712 (An issue in MongoDB Server's Queryable Encryption maintenance operatio ...)
- mongodb <removed>
CVE-2026-18711 (An issue in MongoDB Server's query execution engine could allow an aut ...)
@@ -1970,7 +2053,7 @@ CVE-2026-18688 (An issue in MongoDB Server's aggregation framework could allow a
CVE-2026-18687 (MongoDB Server's handling of a Queryable Encryption maintenance operat ...)
- mongodb <removed>
CVE-2026-18640 (The NewNotebook API does not sufficiently sanitize its parameters allo ...)
- TODO: check
+ NOT-FOR-US: Velociraptor
CVE-2026-18639 (When Velociraptor is configured to use an OIDC IdP for authentication, ...)
NOT-FOR-US: Velociraptor
CVE-2026-18638 (Any authenticated Velociraptor user \u2014 including one holding only ...)
@@ -1992,27 +2075,31 @@ CVE-2026-17535 (Velociraptor's NTFS parsing library mishandles several out of bo
CVE-2026-17061 (A Deserialization of Untrusted Data vulnerability affecting SIMULIA Ex ...)
NOT-FOR-US: Dassault Systemes
CVE-2026-15567 (A flaw was found in Wildfly. A remote unauthenticated attacker can tri ...)
- TODO: check
+ - wildfly <itp> (bug #752018)
CVE-2026-15565 (A flaw was found in Undertow. A remote attacker can cause Out of Memor ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490628
CVE-2026-15563 (A flaw was found in EAP's IIOP. The listener's NameService would accep ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15562 (A flaw was found in EAP's jboss-remoting. A remote unauthenticated att ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15561 (A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2483133
CVE-2026-15560 (when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attack ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15556 (A flaw was found in Picketlink's SP signature validation; a SAML respo ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15555 (A flaw was found in JBoss marshalling. The Infinispan session replicat ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-15554 (the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attri ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2480601
CVE-2026-15426 (The AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Auto ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14180 (A flaw was found in the ChunkReader component of the Undertow HTTP ser ...)
- TODO: check
+ - undertow <unfixed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2494771
CVE-2026-13739 (A legacy endpoint in Command Center contained an unauthenticated serve ...)
NOT-FOR-US: Commvault
CVE-2026-13738 (CommServe contained an authorization bypass vulnerability affecting a ...)
@@ -2038,17 +2125,17 @@ CVE-2026-11734 (A buffer overflow vulnerability in the listed NETGEAR models all
CVE-2026-11733 (A buffer overflow vulnerability in the listed NETGEAR models allows a ...)
NOT-FOR-US: Netgear
CVE-2026-10579 (A flaw was found in Picketlink Federation SAML; the unsolcited respons ...)
- TODO: check
+ NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
CVE-2026-0465 (A Use\u2011After\u2011Free (UAF) vulnerability in the AMD Ryzen\u2122 ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2025-8087 (A DLL hijacking vulnerability in AMD Power Design Manager could allow ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2025-61970 (Weak permissions in the Vitis\u2122 Unified installation path on local ...)
TODO: check
CVE-2025-54512 (A DLL hijacking vulnerability within the AMD Ryzen Master installation ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2025-48506 (Uncontrolled search paths in Vitis\u2122 Unified installation path on ...)
- TODO: check
+ NOT-FOR-US: AMD
CVE-2025-48505 (Weak permissions in the Vitis\u2122 Unified installation path on local ...)
TODO: check
CVE-2025-35987 (Omission of security-relevant information for some Intel(R) Software G ...)
@@ -2163,11 +2250,11 @@ CVE-2025-31936 (Improper handling of overlap between protected memory ranges for
NOTE: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260811
NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html
CVE-2026-71194
- - designate <unfixed> (bug #1144145)
+ - designate 1:22.0.0-2 (bug #1144145)
NOTE: https://bugs.launchpad.net/designate/+bug/2160533
NOTE: https://security.openstack.org/ossa/OSSA-2026-034.html
CVE-2026-71193
- - designate <unfixed> (bug #1144145)
+ - designate 1:22.0.0-2 (bug #1144145)
NOTE: https://bugs.launchpad.net/designate/+bug/2160533
NOTE: https://security.openstack.org/ossa/OSSA-2026-034.html
CVE-2026-XXXX [GHSA-8688-9x26-hhxj]
@@ -2424,13 +2511,13 @@ CVE-2026-6426 (A type mismatch vulnerability was found in QEMU's vhost inflight
CVE-2026-6181 (The Device Configuration Framework is vulnerable to an authentication ...)
NOT-FOR-US: Axis Communication
CVE-2026-69118 (Cachet through 2.4.1 contains a server-side template injection vulnera ...)
- TODO: check
+ NOT-FOR-US: Cachet
CVE-2026-69116 (FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering an ...)
NOT-FOR-US: FlyEnv
CVE-2026-69114 (Spacebar Server before commit 8d126f4 contains a cross-channel message ...)
TODO: check
CVE-2026-69112 (Hugging Face Accelerate through 1.14.0 contains a path traversal vulne ...)
- TODO: check
+ NOT-FOR-US: Hugging Face Accelerate
CVE-2026-66779 (Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver App ...)
NOT-FOR-US: SAP
CVE-2026-66778 (SAP Approuter does not sufficiently sanitize certain request headers b ...)
@@ -2460,7 +2547,9 @@ CVE-2026-66761 (SAP Approuter does not enforce sufficient flow control in certai
CVE-2026-66760 (SAP Approuter does not correctly validate client certificates in certa ...)
NOT-FOR-US: SAP
CVE-2026-63622 (A flaw was found in libvirt. A local attacker, specifically a process ...)
- TODO: check
+ - libvirt 12.6.0-1
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2513065
+ NOTE: Fixed by: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b (v12.6.0-rc2)
CVE-2026-5304 (An ACAP configuration file lacks input validation, which could potenti ...)
NOT-FOR-US: Axis Communication
CVE-2026-5303 (The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) ra ...)
@@ -2492,9 +2581,9 @@ CVE-2026-58230 (SAP Approuter does not sufficiently validate certain token conte
CVE-2026-4757 (A VAPIX API parameter had improper input validation which could allow ...)
NOT-FOR-US: Axis Communication
CVE-2026-48161 (react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 a ...)
- TODO: check
+ NOT-FOR-US: react18-use
CVE-2026-48160 (react-tracked provides state usage tracking with Proxies. Between 2026 ...)
- TODO: check
+ NOT-FOR-US: react-tracked
CVE-2026-44765 (Due to a Missing Authorization Check vulnerability in SAP Manufacturin ...)
NOT-FOR-US: SAP
CVE-2026-44764 (Due to a Missing Authorization Check vulnerability in SAP Manufacturin ...)
@@ -2506,15 +2595,15 @@ CVE-2026-44762 (SAP Data Services Management Console allows an overly permissive
CVE-2026-44758 (SAP Manufacturing Integration and Intelligence (MII) allows an attacke ...)
NOT-FOR-US: SAP
CVE-2026-44401 (Typemill CMS version 2.x contains a persistent cross-site scripting vu ...)
- TODO: check
+ NOT-FOR-US: Typemill CMS
CVE-2026-40130 (SAP SAPSPrint Service has memory corruption vulnerabilities in the han ...)
NOT-FOR-US: SAP
CVE-2026-34265 (SAP NetWeaver Application Server ABAP allows an unauthenticated attack ...)
NOT-FOR-US: SAP
CVE-2026-24330 (A flaw was found in wildfly-core. A remote attacker, authenticated as ...)
- TODO: check
+ - wildfly <itp> (bug #752018)
CVE-2026-24329 (A flaw was found in wildfly-core. A remote user authenticated as an ad ...)
- TODO: check
+ - wildfly <itp> (bug #752018)
CVE-2026-19518 (Improper Validation of Specified Quantity in Input vulnerability in Sa ...)
TODO: check
CVE-2026-19517 (Improper Validation of Specified Quantity in Input and Allocation of R ...)
@@ -2526,9 +2615,11 @@ CVE-2026-19425 (Travel Agency Management System developed by Win Men Intermation
CVE-2026-19424 (Chiline Cloud developed by Inventec Appliances has a Insecure Direct O ...)
TODO: check
CVE-2026-19411 (A NULL pointer vulnerability has been found in the the shim applicatio ...)
- TODO: check
+ - shim <unfixed> (unimportant)
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2513060
+ NOTE: Considered a hardening change by upstream
CVE-2026-19391 (A flaw was found in insights-core where the password redaction layer f ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-18982 (A flaw was found in the RHOAI training-operator. This vulnerability al ...)
NOT-FOR-US: Red Hat OpenShift AI
CVE-2026-18951 (A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the t ...)
@@ -2891,7 +2982,9 @@ CVE-2026-64941 (URL Redirection to Untrusted Site ('Open Redirect') vulnerabilit
CVE-2026-64940 (Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contai ...)
NOT-FOR-US: Nishishi Factory
CVE-2026-63623 (A flaw was found in libvirt. During storage volume clone or convert op ...)
- TODO: check
+ - libvirt 12.6.0-1
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2513066
+ NOTE: Fixed by: https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825 (v12.6.0-rc2)
CVE-2026-63106 (ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection ...)
NOT-FOR-US: ReadyEcommerceCrafty Controller
CVE-2026-63105 (ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XS ...)
@@ -5873,13 +5966,25 @@ CVE-2026-64663 (Statamic is a Laravel and Git powered content management system
CVE-2026-64662 (Statamic is a Laravel and Git powered content management system (CMS). ...)
NOT-FOR-US: Statamic CMS
CVE-2026-64655 (GitHub CLI (gh) is GitHub\u2019s official command line tool. Prior to ...)
- TODO: check
+ - gh <unfixed>
+ [trixie] - gh <no-dsa> (Minor issue)
+ NOTE: https://github.com/cli/cli/security/advisories/GHSA-mm27-mwq9-fr5g
+ NOTE: https://github.com/cli/cli/commit/55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55 (v2.97.0)
CVE-2026-64654 (GitHub CLI (gh) is GitHub's official command line tool. Prior to versi ...)
- TODO: check
+ - gh <unfixed>
+ [trixie] - gh <no-dsa> (Minor issue)
+ NOTE: https://github.com/cli/cli/security/advisories/GHSA-3m3g-3wcr-px46
+ NOTE: https://github.com/cli/cli/commit/2a1409fe88d416cc85fc96fb5bc473f83ed5a054 (v2.97.0)
CVE-2026-64653 (GitHub CLI (gh) is GitHub\u2019s official command line tool. Prior to ...)
- TODO: check
+ - gh <unfixed>
+ [trixie] - gh <no-dsa> (Minor issue)
+ NOTE: https://github.com/cli/cli/security/advisories/GHSA-4fjg-2h4q-fwg3
+ NOTE: https://github.com/cli/cli/commit/0c2eea6338a2323cfff000160b9b5a56a38d2a06 (v2.97.0)
CVE-2026-64652 (GitHub CLI (gh) is GitHub's official command line tool. Prior to versi ...)
- TODO: check
+ - gh <unfixed>
+ [trixie] - gh <no-dsa> (Minor issue)
+ NOTE: https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm
+ NOTE: https://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3 (v2.97.0)
CVE-2026-63725 (sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup ...)
NOT-FOR-US: sysPass
CVE-2026-63637 (Dgraph is an open source distributed GraphQL database. Prior to 25.3.8 ...)
@@ -8131,7 +8236,8 @@ CVE-2026-18656 (An uncontrolled search path element in Kiro IDE before version 1
CVE-2026-18322 (The Smart Popup by Supsystic plugin for WordPress is vulnerable to Pri ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18103 (A flaw was found in dhcp-server. A remote attacker with network access ...)
- TODO: check
+ - isc-dhcp <removed>
+ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2508081
CVE-2026-17515 (The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-16993 (The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 ...)
@@ -26001,7 +26107,7 @@ CVE-2026-42168 (django-pyas2 through 1.2.3 is vulnerable to OS command injection
CVE-2026-36669 (An unauthenticated arbitrary file upload vulnerability in ck_upload_ha ...)
NOT-FOR-US: Feng Office
CVE-2026-16118 (A flaw was found in xdgmime. A heap-based buffer overflow can be trigg ...)
- - glib2.0 <unfixed> (bug #1142717)
+ - glib2.0 2.88.3-3 (bug #1142717)
[trixie] - glib2.0 <no-dsa> (Minor issue)
[bookworm] - glib2.0 <postponed> (Minor issue; 2-byte OOB write parsing the mime magic file in an XDG data dir, needs an attacker-writable XDG data dir; unfixed upstream)
[bullseye] - glib2.0 <postponed> (Minor issue; 2-byte OOB write parsing the mime magic file in an XDG data dir, needs an attacker-writable XDG data dir; unfixed upstream)
@@ -32345,7 +32451,7 @@ CVE-2026-12170 (The AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketin
CVE-2026-12116 (A vulnerability in the Xerte Online Tools allows for RCE through the a ...)
NOT-FOR-US: Xerte Online Tools
CVE-2026-11404 (Cesanta Mongoose before 7.22 contains an out-of-bounds read in the bui ...)
- TODO: check
+ - mongoose 7.22+ds-1
CVE-2026-11359 (The Memberships and User Profiles for WooCommerce \u2013 ProfileGrid W ...)
NOT-FOR-US: WordPress plugin
CVE-2026-0287 (Multiple denial of service vulnerabilities in Palo Alto Networks PAN-O ...)
@@ -35139,6 +35245,8 @@ CVE-2026-53361 (In the Linux kernel, the following vulnerability has been resolv
- linux 7.1.3-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/d82ba05263c69fa2437fe93e4e561cc40f4c03af (7.1-rc3)
+ NOTE: https://www.linkedin.com/pulse/badgarbagec-afunix-container-escape-resurrected-twice-oldani-sicvf/
+ NOTE: https://github.com/sgkdev/bad_garbage
CVE-2026-53359 (In the Linux kernel, the following vulnerability has been resolved: K ...)
{DSA-6381-1 DLA-4700-1 DLA-4688-1}
- linux 7.1.3-1
@@ -47074,8 +47182,6 @@ CVE-2026-56229 (Capgo before 12.128.2 contains an authorization bypass vulnerabi
CVE-2026-12804 (A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is ...)
- lemonldap-ng 2.23.1+ds-1
[trixie] - lemonldap-ng <no-dsa> (Minor issue)
- [bookworm] - lemonldap-ng <postponed> (Minor issue; open redirect in rarely-used SAML CDC endpoint; fix in 2.23.1)
- [bullseye] - lemonldap-ng <postponed> (Minor issue; open redirect in rarely-used SAML CDC endpoint; fix in 2.23.1)
NOTE: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3619
NOTE: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/merge_requests/979
NOTE: Fixed by: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/478bed8e58f0457235e0916e3f73a85a2f19471f (v2.23.1)
@@ -484358,7 +484464,7 @@ CVE-2022-30765 (Calibre-Web before 0.6.18 allows user table SQL Injection.)
CVE-2022-30764
RESERVED
CVE-2022-30763 (Janet before 1.22.0 mishandles arrays.)
- - janet <itp> (bug #983003)
+ - janet <not-affected> (Fixed before initial upload to Debian)
CVE-2022-30762
RESERVED
CVE-2022-30761
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,7 @@
+[12 Aug 2026] DLA-4734-1 lemonldap-ng - security update
+ {CVE-2026-12804 CVE-2026-19349}
+ [bullseye] - lemonldap-ng 2.0.11+ds-4+deb11u9
+ [bookworm] - lemonldap-ng 2.16.1+ds-deb12u9
[11 Aug 2026] DLA-4733-1 php7.4 - security update
{CVE-2026-7260 CVE-2026-17543}
[bullseye] - php7.4 7.4.33-1+deb11u12
=====================================
data/dla-needed.txt
=====================================
@@ -295,10 +295,6 @@ ldap-account-manager
NOTE: 20260725: Also add for bookworm (8.3); CVE-2026-27894 PDF-export LFI,
NOTE: 20260725: unvalidated pdf_structure/pdf_font identical to bullseye. (utkarsh/front-desk)
--
-lemonldap-ng (yadd)
- NOTE: 20260811: CVE-2026-19349 (major)
- NOTE: 20260811: CVE-2026-12804 (minor)
---
libarchive
NOTE: 20260804: Added by Front-Desk. Take care of CVE-2026-15028 (rouca)
--
@@ -321,7 +317,7 @@ libcryptx-perl
NOTE: 20260725: tag Copy and CVE-2026-13758 memNE both present. Sponsored in
NOTE: 20260725: both suites. (utkarsh/front-desk)
--
-libdbi-perl
+libdbi-perl (guilhem)
NOTE: 20260801: Added by Front-Desk (ta)
--
libde265
@@ -346,7 +342,7 @@ libio-compress-perl
libmojo-jwt-perl
NOTE: 20260805: Added by Front-Desk (rouca)
--
-libnet-dns-perl
+libnet-dns-perl (guilhem)
NOTE: 20260802: Added by Front-Desk (ta)
--
librabbitmq
@@ -760,7 +756,7 @@ request-tracker4/bullseye (Andrew Ruthven)
NOTE: 20260529: Follow DSA in preparation by maintainer (dleidert/front-desk)
NOTE: 20260607: Andrew Ruthven (maintainer) is working on a DLA.
--
-roundcube
+roundcube (guilhem)
NOTE: 20260811: Added by Front-Desk (charles)
NOTE: 20260811: Already in dsa-needed, sync and help secteam for sid/trixie.
NOTE: 20260811: trixie and bookworm have the same minor version for which
=====================================
data/next-point-update.txt
=====================================
@@ -336,3 +336,5 @@ CVE-2026-48120
[trixie] - kakoune 2024.05.18-2+deb13u1
CVE-2026-1836
[trixie] - redmine 6.0.10+ds-1
+CVE-2026-11487
+ [trixie] - neovim 0.10.4-8+deb13u1
=====================================
lib/python/security_db.py
=====================================
@@ -268,9 +268,12 @@ class DB:
misnomer because these objects are quite versatile.
"""
- def __init__(self, name, verbose=False):
+ def __init__(self, name, *, verbose=False, readonly=False):
self.name = name
- self.db = apsw.Connection(name)
+ flags = apsw.SQLITE_OPEN_READWRITE | apsw.SQLITE_OPEN_CREATE
+ if readonly:
+ flags = apsw.SQLITE_OPEN_READONLY
+ self.db = apsw.Connection(name, flags=flags)
self.verbose = verbose
c = self.cursor()
@@ -279,18 +282,26 @@ class DB:
c.execute("PRAGMA page_size = 4096")
- # Enable WAL. This means that updates will not block readers.
- c.execute("PRAGMA journal_mode = WAL")
+ if not readonly:
+ # Enable WAL. This means that updates will not block readers.
+ c.execute("PRAGMA journal_mode = WAL")
self.schema_version = 24
self._initFunctions()
- for (v,) in c.execute("PRAGMA user_version"):
- if v == 0:
+ try:
+ user_version, = next(c.execute("PRAGMA user_version"))
+ except StopIteration:
+ raise RuntimeError("no user_version returned from sqlite")
+ if user_version != self.schema_version:
+ if readonly:
+ raise RuntimeError("DB: readonly open failed. expected schema version %d mismatches database schema version %d"
+ % (self.schema_version, user_version))
+ elif user_version == 0:
self.initSchema(c)
- elif v == 20:
+ elif user_version == 20:
self._initSchema20(c)
- elif v == 21:
+ elif user_version == 21:
# Remove legacy views.
for view in ('testing_status', 'stable_status',
'oldstable_status'):
@@ -299,18 +310,16 @@ class DB:
except apsw.SQLError:
pass
c.execute("PRAGMA user_version = 22")
- elif v == 22:
+ elif user_version == 22:
self._initSchema22(c)
- elif v == 23:
+ elif user_version == 23:
self._initSchema23(c)
- elif v != self.schema_version:
+ else:
if self.verbose:
print("DB: schema version mismatch: expected %d, got %d"
- % (self.schema_version, v))
- raise SchemaMismatch(repr(v))
- self._initViews(c)
- return
- assert False
+ % (self.schema_version, user_version))
+ raise SchemaMismatch(repr(user_version))
+ self._initViews(c)
def __del__(self):
self.db.close()
@@ -487,7 +496,6 @@ class DB:
def _initSchema20(self, cursor):
cursor.execute("PRAGMA user_version = 1")
self._initNoDSA(cursor)
- self._initViews(cursor)
cursor.execute("DELETE FROM inodeprints WHERE file ='data/CVE/list'")
cursor.execute("PRAGMA user_version = %d" % self.schema_version)
=====================================
lib/python/web_support.py
=====================================
@@ -618,33 +618,31 @@ class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
RE_BASE_URL = re.compile(r'^(https?)://([^/]+)(.*)')
-class WebServiceHTTP(WebServiceBase):
- def __init__(self, socket_name):
- WebServiceBase.__init__(self)
+
+class WebServiceHTTPAdapter:
+ def __init__(self, service: WebServiceBase, socket_name):
+ self.service = service
(base_url, address, port) = socket_name
self.lock = threading.Lock()
self.__parse_base_url(base_url)
- service_self = self
+ adapter_self = self
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
(method, path, remaining, params) = self.route()
if path is None:
return
- url = URLFactory(service_self.server_name,
- service_self.script_name,
+ url = URLFactory(adapter_self.service.server_name,
+ adapter_self.service.script_name,
path, params,
- secure=service_self.secure)
+ secure=adapter_self.service.secure)
- service_self.lock.acquire()
- try:
+ with adapter_self.lock:
r = method(remaining, params, url)
assert isinstance(r, Result), repr(r)
result = r.flatten_later()
- finally:
- service_self.lock.release()
result(self)
do_HEAD = do_GET
@@ -660,14 +658,14 @@ class WebServiceHTTP(WebServiceBase):
def route(self):
(path, params) = self.__parse_path()
- prefix_len = len(service_self.script_name)
+ prefix_len = len(adapter_self.service.script_name)
prefix = path[0:prefix_len]
result = None
- if prefix == service_self.script_name:
+ if prefix == adapter_self.service.script_name:
suffix = path[prefix_len:]
try:
(method, remaining) = \
- service_self.router.get(suffix)
+ adapter_self.service.router.get(suffix)
return (method, suffix, remaining, params)
except InvalidPath:
pass
@@ -683,9 +681,9 @@ class WebServiceHTTP(WebServiceBase):
m = RE_BASE_URL.match(url)
if m is None:
raise ValueError("invalid base URL: " + url)
- self.secure = m.group(1) == "https"
- self.server_name = m.group(2)
- self.script_name = m.group(3)
+ self.service.secure = m.group(1) == "https"
+ self.service.server_name = m.group(2)
+ self.service.script_name = m.group(3)
def __test():
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c7431aca9ba923f4ac31f093a705371e0ceac149...1a274edc344a2e6865555681c0a03f8be8fc754d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c7431aca9ba923f4ac31f093a705371e0ceac149...1a274edc344a2e6865555681c0a03f8be8fc754d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260812/0b5c53cd/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list