[Git][security-tracker-team/security-tracker][master] new python-markdown issue

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
024823e5 by Moritz Muehlenhoff at 2026-11-01T20:11:43+01:00
new python-markdown issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3109,7 +3109,10 @@ CVE-2025-12523 (Broken Object Level Authorization in Users Configuration Endpoin
 CVE-2023-7357 (A remote code execution (RCE) vulnerability was identified in the Flex ...)
 	NOT-FOR-US: Flexera
 CVE-2019-25781 (Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity  ...)
-	TODO: check
+	- python-markdown <unfixed>
+	[trixie] - python-markdown <postponed> (Minor issue, revisit when fixed upstream)
+	NOTE: https://github.com/Python-Markdown/markdown/issues/798
+	NOTE: https://github.com/Python-Markdown/markdown/issues/1654
 CVE-2026-XXXX [GHSA-c968-33g3-wh7p: Package names in vendor/composer/installed.json can escape the vendor directory during install and reinstall]
 	- composer 2.11.0-1
 	NOTE: https://github.com/composer/composer/security/advisories/GHSA-c968-33g3-wh7p



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/024823e5081c6098bf7ad12e216e862991e7a460

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/024823e5081c6098bf7ad12e216e862991e7a460
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261101/062c245d/attachment.htm>