[Git][security-tracker-team/security-tracker][master] Add new ruby-rodauth issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5aa0401b by Salvatore Bonaccorso at 2026-08-29T22:04:24+02:00
Add new ruby-rodauth issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -15,15 +15,25 @@ CVE-2026-82473 (KubeEdge CloudCore through 1.23.1 accepts node task status repor
 CVE-2026-82472 (Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upl ...)
 	NOT-FOR-US: Documenso
 CVE-2026-82470 (Rodauth before 2.47.0 contains a time-based one-time password reuse vu ...)
-	TODO: check
+	- ruby-rodauth <unfixed>
+	NOTE: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hhvg-6qmv-58vc
+	NOTE: Fixed by: https://github.com/jeremyevans/rodauth/commit/3bfd0a11bae70935b1944e71dbe787dd0c3a62ad (2.47.0)
 CVE-2026-82469 (Rodauth before 2.47.0 contains an authentication bypass vulnerability  ...)
-	TODO: check
+	- ruby-rodauth <unfixed>
+	NOTE: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2
+	NOTE: Fixed by: https://github.com/jeremyevans/rodauth/commit/8174690cef743177111fb1d9184d129ff4700933 (2.47.0)
 CVE-2026-82468 (Rodauth before 2.47.0 contains a cross-site request forgery protection ...)
-	TODO: check
+	- ruby-rodauth <unfixed>
+	NOTE: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79
+	NOTE: Fixed by: https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a (2.47.0)
 CVE-2026-82467 (Rodauth before 2.47.0 fails to validate protocol-relative return-to pa ...)
-	TODO: check
+	- ruby-rodauth <unfixed>
+	NOTE: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
+	NOTE: Fixed by: https://github.com/jeremyevans/rodauth/commit/295044a92e358479afdf84f905dd5efe89c39aea (2.47.0)
 CVE-2026-82466 (Rodauth before 2.46.0 contains an authentication bypass vulnerability  ...)
-	TODO: check
+	- ruby-rodauth 2.46.0-1
+	NOTE: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75
+	NOTE: Fixed by: https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840 (2.46.0)
 CVE-2026-82465 (pac4j-saml before 6.5.6 does not require signature validation of SAML  ...)
 	TODO: check
 CVE-2026-82464 (pac4j-core before 6.5.6 contains an open redirect vulnerability in Def ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5aa0401b36d874466f4ed57af960c1c707438d5f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5aa0401b36d874466f4ed57af960c1c707438d5f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260829/72118cc9/attachment.htm>