[Git][security-tracker-team/security-tracker][master] new fastnetmon issues

Moritz Muehlenhoff (@jmm) jmm at debian.org
Wed May 27 14:15:26 BST 2026



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8920e6cd by Moritz Muehlenhoff at 2026-05-27T15:15:18+02:00
new fastnetmon issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -1795,35 +1795,87 @@ CVE-2026-48864 (A flaw was found in libsolv. This heap buffer overflow occurs du
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460425
 	NOTE: Not considered a security risk per upstream, as issue is in solv file parser
 CVE-2026-48697 (FastNetMon Community Edition through 1.2.9 does not verify TLS certifi ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed>
+	[trixie] - fastnetmon <no-dsa> (Minor issue)
+	[bookworm] - fastnetmon <no-dsa> (Minor issue)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48697-missing-tls-validation
 CVE-2026-48696 (FastNetMon Community Edition through 1.2.9 has a buffer overflow, a di ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48696-exabgp-sprintf-overflow
+	NOTE: Crosses no real security boundary, requires attacker to modify config file
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1050
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/97b04568b6f12977aedb9682fcd9ca7ca952e84a
 CVE-2026-48695 (FastNetMon Community Edition through 1.2.9 contains an OS command inje ...)
-	NOT-FOR-US: MikroTik
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection
+	NOTE: Crosses no meaningful security boundary
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1047
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/54a95427a1f6fe0237ddb0c3fc14622df1c93870
 CVE-2026-48694 (FastNetMon Community Edition through 1.2.9 contains a configuration in ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection
+	NOTE: Crosses no meaningful security boundary
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1049
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/6f58184fb60248df011c4c379bf445e07609ad27
 CVE-2026-48693 (FastNetMon Community Edition through 1.2.9 is vulnerable to a local sy ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48693-symlink-tmp
+	NOTE: Neutralised by Debian tmp hardening
 CVE-2026-48692 (FastNetMon Community Edition through 1.2.9 exposes a gRPC API server o ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth
+	NOTE: Not a vulnerability by itself, controlling access is the responsibility of the deployment
 CVE-2026-48691 (FastNetMon Community Edition through 1.2.9 contains an integer overflo ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48691-bgp-as-path-overflow
+	NOTE: Not a vulnerability, at best an interop issue
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/94c66d5b100c42fb8bd10a22ca595e46895d60d0
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1054
 CVE-2026-48690 (FastNetMon Community Edition through 1.2.9 contains an integer overflo ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48690-packet-storage-integer-overflow
+	NOTE: Crosses no real security boundary, requires attacker to modify config file
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/4606af43731055297063177263c0107b82ef8986
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1056
 CVE-2026-48689 (FastNetMon Community Edition through 1.2.9 contains an off-by-one heap ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed>
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48689-dynamic-buffer-off-by-one
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1051
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/fa80390ed446f887ca6fa39c9e5b6fff8846e822
 CVE-2026-48688 (FastNetMon Community Edition through 1.2.9 contains multiple out-of-bo ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed>
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48688-bgp-mp-reach-nlri-ipv6
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/04e26ac2e0861efe7a50f3c3fd27e57f840aa4a3
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1055
 CVE-2026-48687 (FastNetMon Community Edition through 1.2.9 contains an OS command inje ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48687-juniper-cmd-injection
+	NOTE: Crosses no meaningful security boundary
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1049
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/6f58184fb60248df011c4c379bf445e07609ad27
 CVE-2026-48686 (FastNetMon Community Edition through 1.2.9 contains a stack-based buff ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48686-bgp-nlri-stack-overflow
+	NOTE: Crosses no meaningful security boundary, if there's an rogue BGP peer, there's bigger issues
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1053
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/265a767635767d7a08391dbe7f98f750d2ea04d0
 CVE-2026-48685 (FastNetMon Community Edition through 1.2.9 has out-of-bounds memory ac ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48685-bgp-extended-length
+	NOTE: Not a vulnerability, at best an interop issue
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/2bf813b2590b9847308877a65fc72df560dd282f
 CVE-2026-48684 (FastNetMon Community Edition through 1.2.9 contains an out-of-bounds r ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48684-netflow-v9-options-oob
+	NOTE: Not a vulnerability by itself, controlling access is the responsibility of the deployment
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/aa1069abaa8624e50b5d0c6c8ccd0f5d9ddc111e
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1057
 CVE-2026-48683 (FastNetMon Community Edition through 1.2.9 contains an out-of-bounds r ...)
-	NOT-FOR-US: FastNetMon Community Edition
+	- fastnetmon <unfixed> (unimportant)
+	NOTE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48683-netflow-v9-data-oob
+	NOTE: Not a vulnerability by itself, controlling access is the responsibility of the deployment
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/commit/aa1069abaa8624e50b5d0c6c8ccd0f5d9ddc111e
+	NOTE: https://github.com/pavel-odintsov/fastnetmon/pull/1057
 CVE-2026-48136 (When Compliance is enabled on Check Point Multi-Domain Management, an  ...)
 	NOT-FOR-US: Check Point Multi-Domain Management
 CVE-2026-48135 (A Check Point HTTP-based service can incorrectly handle malformed HTTP ...)


=====================================
data/dsa-needed.txt
=====================================
@@ -29,6 +29,8 @@ dovecot
 --
 expat
 --
+fastnetmon
+--
 firebird3.0
 --
 firebird4.0/stable



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8920e6cd82168964e20ea5f45703ecde35cb5948

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8920e6cd82168964e20ea5f45703ecde35cb5948
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260527/eb36f41f/attachment.htm>


More information about the debian-security-tracker-commits mailing list