[Git][security-tracker-team/security-tracker][master] 5 commits: dla: drop node-bn.js
Sylvain Beucler (@beuc)
gitlab at salsa.debian.org
Thu Mar 26 08:44:32 GMT 2026
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7348c818 by Sylvain Beucler at 2026-03-26T09:44:10+01:00
dla: drop node-bn.js
1 no-dsa issue, no sponsors, low popcon
- - - - -
63aa1f57 by Sylvain Beucler at 2026-03-26T09:44:12+01:00
dla: drop node-elliptic
1 stalled issue, no sponsors, low popcon
- - - - -
8afa51cd by Sylvain Beucler at 2026-03-26T09:44:12+01:00
dla: drop universal-ctags
1 unimportant issue
- - - - -
e03ba36d by Sylvain Beucler at 2026-03-26T09:44:15+01:00
dla: drop django-allauth
No activity in stable/oldstable, no sponsors, low popcon
- - - - -
6613b276 by Sylvain Beucler at 2026-03-26T09:44:17+01:00
dla: drop ccextractor
Not in stable/oldstable, no sponsors, low popcon
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -11078,6 +11078,7 @@ CVE-2026-27983 (Incorrect Privilege Assignment vulnerability in designthemes LMS
NOT-FOR-US: WordPress plugin or theme
CVE-2026-27982 (An open redirect vulnerability exists in django-allauth versions prior ...)
- django-allauth 65.15.0-1 (bug #1130044)
+ [bullseye] - django-allauth <postponed> (Minor issue, open redirect)
NOTE: https://allauth.org/news/2026/02/django-allauth-65.14.1-released/
CVE-2026-27898 (Vaultwarden is an unofficial Bitwarden compatible server written in Ru ...)
- vaultwarden <itp> (bug #1067023)
@@ -15379,6 +15380,7 @@ CVE-2026-2894 (A vulnerability was identified in funadmin up to 7.1.0-rc4. Affec
NOT-FOR-US: funadmin
CVE-2026-2889 (A vulnerability was detected in CCExtractor up to 0.96.5. Affected is ...)
- ccextractor <removed>
+ [bullseye] - ccextractor <postponed> (Fix along with next DLA)
NOTE: https://github.com/CCExtractor/ccextractor/issues/2055
NOTE: https://github.com/CCExtractor/ccextractor/pull/2057
NOTE: Fixed by: https://github.com/CCExtractor/ccextractor/commit/fd7271bae238ccb3ae8a71304ea64f0886324925 (v0.96.6)
@@ -16296,6 +16298,7 @@ CVE-2026-2739 (This affects versions of the package bn.js before 5.2.3. Calling
- node-bn.js 5.2.3+~5.2.0-1 (bug #1128619)
[trixie] - node-bn.js <no-dsa> (Minor issue)
[bookworm] - node-bn.js <no-dsa> (Minor issue)
+ [bullseye] - node-bn.js <postponed> (Minor issue, DoS)
NOTE: https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301
NOTE: https://github.com/indutny/bn.js/issues/316
NOTE: https://github.com/indutny/bn.js/issues/186
@@ -21318,6 +21321,7 @@ CVE-2026-2246 (A security vulnerability has been detected in AprilRobotics april
NOT-FOR-US: AprilRobotics apriltag
CVE-2026-2245 (A vulnerability was identified in CCExtractor up to 183. This affects ...)
- ccextractor <removed>
+ [bullseye] - ccextractor <postponed> (Minor issue, OOB read)
NOTE: https://github.com/CCExtractor/ccextractor/issues/2053
NOTE: https://github.com/CCExtractor/ccextractor/pull/2057
CVE-2026-2242 (A vulnerability was determined in janet-lang janet up to 1.40.1. This ...)
@@ -33396,6 +33400,7 @@ CVE-2025-14574 (The weDocs plugin for WordPress is vulnerable to Sensitive Infor
NOT-FOR-US: WordPress plugin
CVE-2025-14505 (The ECDSA implementation of the Elliptic package generates incorrect s ...)
- node-elliptic <unfixed> (bug #1125180)
+ [bullseye] - node-elliptic <postponed> (Revisit when fixed upstream)
NOTE: https://github.com/indutny/elliptic/issues/321
NOTE: https://github.com/indutny/elliptic/pull/345
CVE-2025-14436 (The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored ...)
@@ -45192,6 +45197,7 @@ CVE-2025-65431 (An issue was discovered in allauth-django before 65.13.0. Both O
NOTE: https://github.com/pennersr/django-allauth/commit/8feef46e0e07b25fc5594c8f268afa247ebc3412 (65.13.0)
CVE-2025-65430 (An issue was discovered in allauth-django before 65.13.0. IdP: marking ...)
- django-allauth 65.15.0-1 (bug #1123085)
+ [bullseye] - django-allauth <postponed> (Fix along with next DLA)
NOTE: https://allauth.org/news/2025/10/django-allauth-65.13.0-released/
CVE-2025-65213 (MooreThreads torch_musa through all versions contains an unsafe deseri ...)
NOT-FOR-US: MooreThreads torch_musa
=====================================
data/dla-needed.txt
=====================================
@@ -62,16 +62,10 @@ ca-certificates
calibre (Abhijith PA)
NOTE: 20260222: Added by Front-Desk (rouca)
--
-ccextractor
- NOTE: 20260216: Added by Front-Desk (rouca)
---
ckeditor
NOTE: 20241002: Added by Front-Desk (Beuc)
NOTE: 20241002: Multiple CVEs have been piling up (Beuc/front-desk)
--
-django-allauth
- NOTE: 20260216: Added by Front-Desk (rouca)
---
docker.io
NOTE: 20250805: Added by Front-Desk (rouca)
--
@@ -296,12 +290,6 @@ netty (rouca)
NOTE: 20251127: all CVEs fixed under sid (rouca)
NOTE: 20260114: fix remaining CVE wait DSA (rouca)
--
-node-bn.js
- NOTE: 20260222: Added by Front-Desk (rouca)
---
-node-elliptic
- NOTE: 20260216: Added by Front-Desk (rouca)
---
node-lodash (utkarsh)
NOTE: 20260131: Added by Front-Desk (Beuc)
NOTE: 20260201: this package is pure madness - 290 vendored sources and origtars. :)
@@ -463,9 +451,6 @@ trafficserver
NOTE: 20250403: There are multiple new CVEs. But none of them is addresses in Sid and maintainers didn't reply to me last time (dleidert)
NOTE: 20250405: DSA 5896-1 is out (Beuc/front-desk)
--
-universal-ctags
- NOTE: 20260219: Added by Front-Desk (rouca)
---
vim (paride)
NOTE: 20260217: Added by Front-Desk (rouca)
NOTE: 20260228: I enabled the salsa pipeline, there are (previously undetected)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5ab4cc6cdef4fb3cf3eb72e59eae3678e87139a4...6613b276ae51fb03ca5c1052bf0ea8f0d5d040a6
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5ab4cc6cdef4fb3cf3eb72e59eae3678e87139a4...6613b276ae51fb03ca5c1052bf0ea8f0d5d040a6
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260326/20465a65/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list