[Git][security-tracker-team/security-tracker][master] Add new python-sh issue

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
26f970ee by Salvatore Bonaccorso at 2026-08-22T08:55:14+02:00
Add new python-sh issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5955,7 +5955,10 @@ CVE-2026-54730 (authentik is an open-source identity provider. Prior to 2026.2.6
 CVE-2026-54570 (AngleSharp is a .NET library for parsing angle bracket based hyper-tex ...)
 	NOT-FOR-US: AngleSharp
 CVE-2026-54552 (sh provides Python process launching. Prior to 2.2.4, the _uid option  ...)
-	TODO: check
+	- python-sh <unfixed>
+	NOTE: https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55
+	NOTE: https://github.com/amoffat/sh/pull/776
+	NOTE: Fixed by: https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1 (2.2.4)
 CVE-2026-53533 (aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior  ...)
 	- aiosmtplib 5.1.2-1
 	NOTE: https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26f970ee8f8cfe3c2bc4241439f98415db290800

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26f970ee8f8cfe3c2bc4241439f98415db290800
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260822/08158bc0/attachment.htm>