[Git][security-tracker-team/security-tracker][master] 5 commits: lts: add cacti to dla-needed

Tue Jun 30 04:26:43 BST 2026


Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
629b70e7 by Daniel Leidert at 2026-06-30T02:29:56+02:00
lts: add cacti to dla-needed

- - - - -
fc128f2d by Daniel Leidert at 2026-06-30T02:50:37+02:00
lts: mark CVE-2026-0864 and CVE-2026-11940 as postponed

Mark both issues as postponed for Bullseye (python3.9) and
Bookworm (python3.11).

- - - - -
228b59d3 by Daniel Leidert at 2026-06-30T03:02:05+02:00
lts: mark CVE-2026-9265/libcrypt-openssl-pkcs12-perl as postponed

- - - - -
c89e310a by Daniel Leidert at 2026-06-30T03:18:52+02:00
Add patch links for CVE-2026-54369,CVE-2026-54370/acl

The list might be incomplete, though, because the patches are based on a
complete haulover of the walk_tree helper.

IMHO this might be really hard to backport and seems very intrusive for all
releases, except Forky and Sid which could receive 2.4.0.

- - - - -
74a44ac6 by Daniel Leidert at 2026-06-30T03:26:52+02:00
Add patch links for CVE-2026-54371/attr

The list might be incomplete, though, because the patches are based on a
complete haulover of the walk_tree helper.

IMHO this might be really hard to backport and seems very intrusive for all
releases, except Forky and Sid which could receive 2.6.0.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -292,14 +292,27 @@ CVE-2026-54371 (attr before version 2.6.0 contains a symlink traversal vulnerabi
 	- attr <unfixed> (bug #1141107)
 	[trixie] - attr <no-dsa> (Will be fixed first in unstable, then point release update)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/06/29/1
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=641ea6fcc556c1f34b77efb9cd3f876dff0a0a07 (v2.6.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=3fb06b9ba314d37035d0877e6de313de754f1ac8 (v2.6.0)
+	NOTE: The fixes are based on a complete rewrite of the walk_tree helper.
 CVE-2026-54370 (acl before version 2.4.0 contains a time-of-check to time-of-use (TOCT ...)
 	- acl <unfixed> (bug #1141110)
 	[trixie] - acl <no-dsa> (Will be fixed first in unstable, then point release update)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/06/29/1
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=601cc884a548ae9e9d246ae749e54b3272e4b1d7 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=54e14e9bc545f505b379d0792a2748d9baf88700 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=2c03ceefa0610d551d9cc089ce0a404cbe2d34b4 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=2ee940139e9bba5005a3d987a6daecdda909089e (v2.4.0)
+	NOTE: The fixes are based on a complete rewrite of the walk_tree helper.
 CVE-2026-54369 (acl before version 2.4.0 contains a symlink traversal vulnerability in ...)
 	- acl <unfixed> (bug #1141110)
 	[trixie] - acl <no-dsa> (Will be fixed first in unstable, then point release update)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/06/29/1
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=601cc884a548ae9e9d246ae749e54b3272e4b1d7 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=54e14e9bc545f505b379d0792a2748d9baf88700 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=2c03ceefa0610d551d9cc089ce0a404cbe2d34b4 (v2.4.0)
+	NOTE: Fixed by: https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=2ee940139e9bba5005a3d987a6daecdda909089e (v2.4.0)
+	NOTE: The fixes are based on a complete rewrite of the walk_tree helper.
 CVE-2026-9676 (The F4 Post Tree WordPress plugin before 2.0.5 does not perform capabi ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-13544 (A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue ...)
@@ -5466,7 +5479,9 @@ CVE-2026-0864 (When using the "configparser" module to write configuration files
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <removed>
+	[bookworm] - python3.11 <postponed> (Minor issue)
 	- python3.9 <removed>
+	[bullseye] - python3.9 <postponed> (Minor issue)
 	- python2.7 <removed>
 	[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
 	- pypy3 <unfixed>
@@ -5556,7 +5571,9 @@ CVE-2026-11940 (tarfile.extractall() with the 'data' or 'tar'  filter could be b
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <removed>
+	[bookworm] - python3.11 <postponed> (Minor issue)
 	- python3.9 <removed>
+	[bullseye] - python3.9 <postponed> (Minor issue)
 	- python2.7 <removed>
 	[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
 	- pypy3 <unfixed>
@@ -6476,6 +6493,7 @@ CVE-2026-9375 (urllib3 version 2.6.3 is vulnerable to a decompression bomb bypas
 CVE-2026-9265 (Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OO ...)
 	- libcrypt-openssl-pkcs12-perl 1.96-1 (bug #1140426)
 	[trixie] - libcrypt-openssl-pkcs12-perl <no-dsa> (Minor issue)
+	[bullseye] - libcrypt-openssl-pkcs12-perl <postponed> (Minor issue, can be fixed with next update)
 	NOTE: https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55
 	NOTE: Fixed by: https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/a7bd2f319fa8aab8177b3d767ea06dd85ceb3173 (v1.96)
 CVE-2026-56216 (Capgo before 12.128.2 contains a scope escalation vulnerability in the ...)


=====================================
data/dla-needed.txt
=====================================
@@ -103,6 +103,10 @@ ca-certificates/bullseye
   NOTE: 20260216: partial update under debusine https://debusine.debian.net/debian/developers/work-request/446642/
   NOTE: 20260220: Release partial DLA 4485-1
 --
+cacti
+  NOTE: 20260630: Added by Front-Desk (dleidert)
+  NOTE: 20260630: A new bunch of issues and in DSA list (dleidert/front-desk)
+--
 calibre/bullseye
   NOTE: 20260222: Added by Front-Desk (rouca)
   NOTE: 20260429: partial update (abhijith)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/35f6ab664e63535c2133ca795c55f515a3ab843a...74a44ac6d2f3aea21a455261765e40591e91b3ce

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/35f6ab664e63535c2133ca795c55f515a3ab843a...74a44ac6d2f3aea21a455261765e40591e91b3ce
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260630/9960e4d2/attachment-0001.htm>
