[Git][security-tracker-team/security-tracker][master] 2 commits: lts: epiphany no-dsa
Emilio Pozuelo Monfort (@pochu)
pochu at debian.org
Mon Nov 2 12:25:08 GMT 2026
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f5fcf923 by Emilio Pozuelo Monfort at 2026-11-02T13:22:50+01:00
lts: epiphany no-dsa
WebKit is EOL so it's only to be used with trusted content.
- - - - -
2952e851 by Emilio Pozuelo Monfort at 2026-11-02T13:22:52+01:00
lts: triage some limited support packages
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1611,6 +1611,7 @@ CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to 11.11,
NOT-FOR-US: Wekan
CVE-2026-119299 (gopacket provides packet processing capabilities for Go. Prior to 1.7. ...)
- golang-github-gopacket-gopacket <unfixed>
+ [bookworm] - golang-github-gopacket-gopacket <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/gopacket/gopacket/security/advisories/GHSA-358w-w75h-x6rx
NOTE: Fixed by: https://github.com/gopacket/gopacket/commit/508044327cc2c065b3db753c010a027e7d1ca621 (v1.7.2)
CVE-2026-119298 (croc is a tool that allows any two computers to simply and securely tr ...)
@@ -3783,24 +3784,28 @@ CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser witho
CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
NOTE: Fixed by: https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 (v4.15.2)
NOTE: Fixed by: https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df (v5.1.1)
CVE-2026-118657 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118656 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Stat ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
NOTE: https://github.com/labstack/echo/issues/2599
NOTE: https://github.com/labstack/echo/pull/3006
@@ -3809,23 +3814,27 @@ CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middlewa
CVE-2026-118654 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118653 (Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq
NOTE: Fixed by: https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2 (v5.1.0)
CVE-2026-118652 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118651 (Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally moun ...)
@@ -3858,6 +3867,7 @@ CVE-2026-118426 (In affected versions of Octopus Server with the LDAP authentica
NOT-FOR-US: Octopus Deploy
CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
@@ -4274,6 +4284,7 @@ CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's E
NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae (v5.4.1)
CVE-2026-118264 (Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8
NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
@@ -4284,15 +4295,18 @@ CVE-2026-118263 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's B
NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
CVE-2026-118262 (Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5
NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
CVE-2026-118261 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc
NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
CVE-2026-118260 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [bookworm] - golang-github-labstack-echo <no-dsa> (Minor issue, limited support)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv
NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
CVE-2026-118259 (opentelemetry-java is the Java implementation of the OpenTelemetry API ...)
@@ -10068,6 +10082,7 @@ CVE-2026-110928
TODO: check, unclear if usptream is affected by the specific issue?
CVE-2026-115683 (A race condition in Epiphany allows a malicious website to bypass the ...)
- epiphany-browser <unfixed> (bug #1152827)
+ [bookworm] - epiphany-browser <no-dsa> (Limited support)
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245
CVE-2026-110522
@@ -12802,6 +12817,7 @@ CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries
- python3.11 <removed>
- jython <unfixed>
[trixie] - jython <no-dsa> (Minor issue)
+ [bookworm] - jython <no-dsa> (Minor issue)
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
NOTE: https://github.com/python/cpython/issues/160097
@@ -24234,6 +24250,7 @@ CVE-2026-104003 (The WP User Avatar / ProfilePress plugin for WordPress is vulne
CVE-2026-102941 (The package github.com/gomarkdown/markdown is a Go library for parsing ...)
- golang-github-gomarkdown-markdown 0.0~git20260725.8435af3-1
[trixie] - golang-github-gomarkdown-markdown <no-dsa> (Minor issue)
+ [bookworm] - golang-github-gomarkdown-markdown <no-dsa> (Minor issue)
NOTE: https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7
NOTE: Fixed by: https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9
CVE-2026-102923 (SparkyFitness is a self-hosted, AI-powered health and fitness tracker ...)
@@ -37141,6 +37158,7 @@ CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify
NOT-FOR-US: IBM
CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions b ...)
- golang-github-hashicorp-go-getter <removed>
+ [bookworm] - golang-github-hashicorp-go-getter <no-dsa> (Limited support)
CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
NOT-FOR-US: IBM
CVE-2026-19494 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
@@ -37588,6 +37606,7 @@ CVE-2026-107387 (music-metadata is a metadata parser for audio and video media f
CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the fr ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8
NOTE: https://github.com/rabbitmq/amqp091-go/pull/377
NOTE: Fixed by: https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3 (v1.14.0)
@@ -43414,11 +43433,13 @@ CVE-2026-103065 (Improper Validation of Specified Quantity in Input vulnerabilit
NOT-FOR-US: WordPress plugin or theme
CVE-2026-118599 (A file overwrite vulnerability exists in Epiphany when installing WebE ...)
- epiphany-browser <unfixed> (bug #1152825)
+ [bookworm] - epiphany-browser <no-dsa> (Limited support)
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/0cc9ab5506689a4b82a4b1a41ad71e895cfa48d4
CVE-2026-118598 (A logic error in Epiphany's site permission handling can cause camera ...)
- epiphany-browser <unfixed> (bug #1152824)
+ [bookworm] - epiphany-browser <no-dsa> (Limited support)
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/480c364890a996d893369b8e09e42e706140fc9e
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b085ea39bb019e33d7da1a7aa1283def9b782610...2952e851491218c07f7c529adb1509fd866a8dbc
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b085ea39bb019e33d7da1a7aa1283def9b782610...2952e851491218c07f7c529adb1509fd866a8dbc
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/96853aa6/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list