[Git][security-tracker-team/security-tracker][master] 3 commits: lts: triage tinyproxy in bookworm/bullseye
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sun Jul 26 04:14:34 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8e8f6ce8 by Utkarsh Gupta at 2026-07-26T07:32:36+05:30
lts: triage tinyproxy in bookworm/bullseye
- - - - -
df71d9ca by Utkarsh Gupta at 2026-07-26T07:45:36+05:30
lts: triage yt-dlp in bookworm
- - - - -
1cd7ab22 by Utkarsh Gupta at 2026-07-26T08:01:18+05:30
dla-needed: rewrap swift NOTE
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -29803,16 +29803,20 @@ CVE-2026-52673 (SQL Injection vulnerability in Cboard v.0.4.2 and before allows
CVE-2026-50574 (yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, ...)
- yt-dlp 2026.06.09-1
[trixie] - yt-dlp <no-dsa> (Minor issue)
+ [bookworm] - yt-dlp <postponed> (Minor issue; only reachable when aria2c is explicitly selected as external downloader for HLS/DASH)
NOTE: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2
CVE-2026-50023 (yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, ...)
- yt-dlp 2026.06.09-1
[trixie] - yt-dlp <no-dsa> (Minor issue)
+ [bookworm] - yt-dlp <postponed> (Minor issue; requires an attacker-supplied URL, --write-subs/--write-thumbnail and the user opening the written shortcut file)
NOTE: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3
NOTE: https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a (2026.06.09)
CVE-2026-50019 (yt-dlp is a command-line audio/video downloader. From 2023.09.24 until ...)
- yt-dlp 2026.06.09-1
[trixie] - yt-dlp <no-dsa> (Minor issue)
+ [bookworm] - yt-dlp <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj
+ NOTE: Introduced with: https://github.com/yt-dlp/yt-dlp/commit/42ded0a429c20ec13dc006825e1508d9a02f0ad4 (2023.09.24)
CVE-2026-4983 (Open VSX Registry does not sanitize SVG files uploaded as extension ic ...)
NOT-FOR-US: Open VSX Registry
CVE-2026-4610 (The ProfileGrid \u2013 User Profiles, Groups and Communities plugin fo ...)
@@ -31870,8 +31874,11 @@ CVE-2026-55740 (Nur-Alam39 bus-ticket (no released versions; latest commit 459ca
CVE-2026-55202 (Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly v ...)
- tinyproxy <unfixed> (bug #1140350)
[trixie] - tinyproxy <no-dsa> (Minor issue)
+ [bookworm] - tinyproxy <postponed> (Minor issue; only exposes the internal stats page, prefix Host match does not bypass BasicAuth verification)
+ [bullseye] - tinyproxy <not-affected> (Host header based stathost matching introduced in 1.11.0; 1.10.0 only matches the port-stripped host from the request URL)
NOTE: https://github.com/tinyproxy/tinyproxy/pull/606
NOTE: Fixed by: https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce
+ NOTE: Introduced by https://github.com/tinyproxy/tinyproxy/commit/734ba1d9702cd7d420c624c3574bec1470ebf590 (1.11.0)
CVE-2026-55201 (Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path trave ...)
NOT-FOR-US: Evil-WinRM
CVE-2026-55200 (libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bou ...)
@@ -31891,12 +31898,17 @@ CVE-2026-54445 (vantage6 is an open-source infrastructure for privacy preserving
CVE-2026-54388 (Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject req ...)
- tinyproxy <unfixed> (bug #1140350)
[trixie] - tinyproxy <no-dsa> (Minor issue)
+ [bookworm] - tinyproxy <not-affected> (Duplicate header keys are rejected by orderedmap_append()/htab_insert(); duplicate Content-Length emission only exists in the hashmap era (<= 1.10.x) and again since the pseudomap switch in 1.11.3)
+ [bullseye] - tinyproxy <postponed> (Minor issue; hashmap_insert() keeps duplicate Content-Length headers, but the desync needs a shared upstream proxy/cache, no upstream release with the fix)
NOTE: https://github.com/tinyproxy/tinyproxy/issues/609
NOTE: https://github.com/tinyproxy/tinyproxy/pull/610
NOTE: Fixed by: https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb
+ NOTE: Reintroduced by https://github.com/tinyproxy/tinyproxy/commit/56404a3dd68e (pseudomap, 1.11.3); not present in 1.11.0-1.11.2 (orderedmap)
CVE-2026-54387 (Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile ...)
- tinyproxy <unfixed> (bug #1140350)
[trixie] - tinyproxy <no-dsa> (Minor issue)
+ [bookworm] - tinyproxy <postponed> (Minor issue; forward proxy does not pool backend connections across clients, exploitation needs a shared upstream proxy/cache, no upstream release with the fix)
+ [bullseye] - tinyproxy <postponed> (Minor issue; forward proxy does not pool backend connections across clients, exploitation needs a shared upstream proxy/cache, no upstream release with the fix)
NOTE: https://github.com/tinyproxy/tinyproxy/issues/609
NOTE: https://github.com/tinyproxy/tinyproxy/pull/610
NOTE: Fixed by: https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb
=====================================
data/dla-needed.txt
=====================================
@@ -807,8 +807,8 @@ swift
NOTE: 20260726: clients (SSRF). Already in ela-needed for buster, so it
NOTE: 20260726: makes sense to fix bookworm+bullseye alongside it;
NOTE: 20260726: trixie (2.35.1) is affected too and should be fixed.
- NOTE: 20260726: Fix is 3 regexes in gatekeeper.py, applies cleanly to
- NOTE: 20260726: 2.30.1 and 2.26.0. (utkarsh/front-desk)
+ NOTE: 20260726: Fix is 3 regexes in gatekeeper.py and applies cleanly
+ NOTE: 20260726: to bookworm 2.30.1 and bullseye 2.26.0. (utkarsh/front-desk)
--
symfony/bullseye
NOTE: 20260521: Added by Front-Desk (Beuc)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/4da64e27a7d7c4e16637cf9c03cc9143013bf6c4...1cd7ab22c78eceaad5559685212ccbaca83aad90
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/4da64e27a7d7c4e16637cf9c03cc9143013bf6c4...1cd7ab22c78eceaad5559685212ccbaca83aad90
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260726/f9f7e912/attachment.htm>
More information about the debian-security-tracker-commits
mailing list