[Git][security-tracker-team/security-tracker][master] 7 commits: CVE-2026-7210,CVE-2026-8328/pypy3: follow bookworm triage
Sylvain Beucler (@beuc)
gitlab at salsa.debian.org
Fri May 22 15:28:17 BST 2026
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2a210312 by Sylvain Beucler at 2026-05-22T16:27:57+02:00
CVE-2026-7210,CVE-2026-8328/pypy3: follow bookworm triage
- - - - -
0dc7c450 by Sylvain Beucler at 2026-05-22T16:27:59+02:00
CVE-2026-7598/libssh2: bullseye postponed
- - - - -
3595e786 by Sylvain Beucler at 2026-05-22T16:28:02+02:00
CVE-2026-46433/lldpd: bullseye postponed
- - - - -
f8e74b0a by Sylvain Beucler at 2026-05-22T16:28:05+02:00
CVE-2026-6357/python-pip: bullseye postponed
- - - - -
0d489ad1 by Sylvain Beucler at 2026-05-22T16:28:05+02:00
dla: add qtsvg-opensource-src
- - - - -
c7768418 by Sylvain Beucler at 2026-05-22T16:28:05+02:00
dla: add dpkg
- - - - -
9505338f by Sylvain Beucler at 2026-05-22T16:28:05+02:00
dla: add sudo
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -2402,6 +2402,7 @@ CVE-2026-46433 [Heap OOB Read in VLAN Decapsulation memmove]
- lldpd 1.0.22-1
[trixie] - lldpd <no-dsa> (Minor issue)
[bookworm] - lldpd <no-dsa> (Minor issue)
+ [bullseye] - lldpd <postponed> (Minor issue, OOB read / DoS)
NOTE: https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3
NOTE: https://github.com/lldpd/lldpd/pull/787
NOTE: Fixed by: https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6 (1.0.22)
@@ -3712,6 +3713,7 @@ CVE-2026-8328 (The ftpcp() function in Lib/ftplib.py was not updated when CVE-2
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
+ [bullseye] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/ITF2BAPBQEPYK3LDMPRSY435JGNHYNDP/
NOTE: https://github.com/python/cpython/pull/149648
NOTE: https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9
@@ -6278,6 +6280,7 @@ CVE-2026-7210 (`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
+ [bullseye] - pypy3 <postponed> (Minor issue)
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/
NOTE: https://github.com/python/cpython/issues/149018
NOTE: https://github.com/python/cpython/pull/149023
@@ -12579,6 +12582,7 @@ CVE-2026-7598 (A security vulnerability has been detected in libssh2 up to 1.11.
- libssh2 1.11.1-3 (bug #1135647)
[trixie] - libssh2 <no-dsa> (Minor issue)
[bookworm] - libssh2 <no-dsa> (Minor issue)
+ [bullseye] - libssh2 <postponed> (Minor issue, unlikely user/pass length)
NOTE: https://github.com/libssh2/libssh2/pull/1858
NOTE: https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
CVE-2026-7597 (A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects th ...)
@@ -15634,7 +15638,9 @@ CVE-2026-6357 (pip prior to version 26.1 would run self-update check functionali
- python-pip <unfixed> (bug #1135110)
[trixie] - python-pip <no-dsa> (Minor issue)
[bookworm] - python-pip <no-dsa> (Minor issue)
+ [bullseye] - python-pip <postponed> (Minor issue, possible execution when installing new Python modules)
NOTE: https://github.com/pypa/pip/pull/13923
+ NOTE: https://github.com/pypa/pip/commit/b369bfc96cc524e00c267e1693290e6599c36bad (26.1)
CVE-2026-6337
REJECTED
CVE-2026-6265 (Insecure preserved inherited permissions vulnerability in Cerberus FTP ...)
=====================================
data/dla-needed.txt
=====================================
@@ -118,6 +118,10 @@ docker.io
dovecot (guilhem)
NOTE: 20260517: Added by Front-Desk (pochu)
--
+dpkg
+ NOTE: 20260522: Added by Front-Desk (Beuc)
+ NOTE: 20260522: See CVE and non-CVE security fixes from OSPU https://bugs.debian.org/1132553 (Beuc/front-desk)
+--
edk2
NOTE: 20251230: Added by Front-Desk (Beuc)
NOTE: 20251230: Lots of postponed issues piled-up (Beuc/front-desk)
@@ -523,6 +527,10 @@ qemu
NOTE: 20260520: Many postponed CVEs piled up (Beuc/front-desk)
NOTE: 20260520: Also SPU/OSPU included a rebuild with updated glibc/glib2.0 (Beuc/front-desk)
--
+qtsvg-opensource-src
+ NOTE: 20260522: Added by Front-Desk (Beuc)
+ NOTE: 20260522: Many postponed CVEs piled up (Beuc/front-desk)
+--
rabbitmq-server
NOTE: 20260504: Added by coordinator (santiago)
NOTE: 20260504: Added to address out-standing minor issues
@@ -591,6 +599,11 @@ spip
strongswan
NOTE: 20260423: Added by Front-Desk (pochu)
--
+sudo
+ NOTE: 20260522: Added by Front-Desk (Beuc)
+ NOTE: 20260522: Follow bookworm 12.14, CVE-2026-35535 part of the high-profile
+ NOTE: 20260522: CrackArmor PoC from Qualys (Beuc/front-desk)
+--
suricata
NOTE: 20250331: re added to fix next bunch of CVEs (ta)
NOTE: 20250825: testing package (ta)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ab4362723c7836ac02e421cfa19877cc50bdd4d2...9505338fd124b0b6c2d004e14f2cb795f605879e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ab4362723c7836ac02e421cfa19877cc50bdd4d2...9505338fd124b0b6c2d004e14f2cb795f605879e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260522/927115a7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list