[Git][security-tracker-team/security-tracker][master] Mark CVE-2026-58040 as not-affected for trixie

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2bea0aa5 by Salvatore Bonaccorso at 2026-08-15T09:17:01+02:00
Mark CVE-2026-58040 as not-affected for trixie

The incomplete fix has not been applied to older suites, so are
not-affected by the concrete CVE. Expand note to make clear that fixing
CVE-2026-58040 completely retains the state.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -18167,8 +18167,10 @@ CVE-2026-58043 (A flaw in Node.js Permission Model enforcement can over-grant fi
 	NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-path-matching-can-over-grant-filesystem-access-cve-2026-58043---high
 CVE-2026-58040 (An incomplete fix has been identified in Node.js: HTTPS Agent TLS sess ...)
 	- nodejs 24.19.0+dfsg+~cs24.13.3-1
+	[trixie] - nodejs <not-affected> (Incomplete fix for CVE-2026-48934 not applied)
 	NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent-session-reuse-can-skip-hostname-verification-cve-2026-58040---medium
 	NOTE: Fixed by: https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62 (v22.23.2)
+	NOTE: CVE exists because of an incomplete fix for  CVE-2026-48934
 CVE-2026-56850 (A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-ar ...)
 	- nodejs 24.19.0+dfsg+~cs24.13.3-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#https-agent-can-reuse-mtls-identities-across-pfx-certificates-cve-2026-56850---medium
@@ -54837,7 +54839,7 @@ CVE-2026-48934 (A flaw in Node.js TLS host verification can cause an attacker to
 	- nodejs 24.17.0+dfsg+~cs24.13.2-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#tls-host-identity-verification-bypass-via-session-reuse-with-different-servername-leads-to-unauthorized-connections-cve-2026-48934---medium
 	NOTE: https://github.com/nodejs/node/commit/fd890ba01d508ac111bbba302981d7fdf734d2ce (v22.23.0)
-	NOTE: See regression under CVE-2026-58040
+	NOTE: When fixing this issue make sure to apply a complete fix to not open up CVE-2026-58040.
 CVE-2026-48930 (A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnam ...)
 	- nodejs 24.17.0+dfsg+~cs24.13.2-1
 	NOTE: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#embedded-nul-hostnames-can-lead-to-silent-authority-rebinding-due-to-c-string-truncation-in-resolver-bindings-cve-2026-48930---medium



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bea0aa535bcb2f90c2068959b57cfc09b8a1ddd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bea0aa535bcb2f90c2068959b57cfc09b8a1ddd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260815/18962360/attachment.htm>