[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Nov 2 13:51:35 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ec7862a6 by Moritz Muehlenhoff at 2026-11-02T14:31:41+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1456,13 +1456,10 @@ CVE-2026-119564 (Plausible Analytics Community Edition through 3.2.1 contains an
NOT-FOR-US: Plausible Analytics
CVE-2026-119563 (phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulner ...)
- phpmyadmin <undetermined>
- TODO: check upstream details
CVE-2026-119562 (phpMyAdmin through 5.2.3 contains an sql injection vulnerability that ...)
- phpmyadmin <undetermined>
- TODO: check upstream details
CVE-2026-119561 (phpMyAdmin through 5.2.3 contains an authentication bypass vulnerabili ...)
- phpmyadmin <undetermined>
- TODO: check upstream details
CVE-2026-119560 (OPNsense core through 26.7.8 contains a configuration injection vulner ...)
NOT-FOR-US: OPNsense
CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerab ...)
@@ -5469,22 +5466,27 @@ CVE-2026-99101 (In the Linux kernel, the following vulnerability has been resolv
NOTE: https://git.kernel.org/linus/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64 (7.3-rc1)
CVE-2026-XXXX [GHSA-chm5-8fg3-g6fw: The default email notification scripts may allow command injection from the recipient address]
- icinga2 2.16.6-1
+ [trixie] - icinga2 <no-dsa> (Minor issue)
NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-chm5-8fg3-g6fw
CVE-2026-XXXX [GHSA-33vf-h78f-99p3: Attacker-Controlled Comparator crashes Array#sort]
- icinga2 2.16.6-1
+ [trixie] - icinga2 <no-dsa> (Minor issue)
NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-33vf-h78f-99p3
CVE-2026-XXXX [GHSA-hhxh-8qx6-pxc3: Multiple instances of log injections]
- icinga2 2.16.6-1
+ [trixie] - icinga2 <no-dsa> (Minor issue)
NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-hhxh-8qx6-pxc3
CVE-2026-XXXX [GHSA-vwj4-g6h6-65gj: ASLR bypass via addresses from API call exception stack trace]
- icinga2 2.16.6-1
+ [trixie] - icinga2 <no-dsa> (Minor issue)
NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-vwj4-g6h6-65gj
CVE-2026-XXXX [ GHSA-2hhr-ccxm-x85p: /v1/objects: supposedly inaccessible related objects can be accessed in filter expressions]
- icinga2 2.16.6-1
+ [trixie] - icinga2 <no-dsa> (Minor issue)
NOTE: https://icinga.com/blog/icinga-2-v2-16-6-and-icinga-web-v2-14-1/
NOTE: https://github.com/Icinga/icinga2/security/advisories/GHSA-2hhr-ccxm-x85p
CVE-2026-XXXX [GHSA-mph2-hvq4-8423: Unauthenticated file read and denial of service through chart endpoints]
@@ -7659,11 +7661,15 @@ CVE-2026-117604 (Grav from 1.7.53.3 before 1.7.53.6 contains an authorization by
NOT-FOR-US: Grav CMS
CVE-2026-117603 (Electrum before 4.7.2 contains a spending limit bypass vulnerability i ...)
- electrum 4.8.1+dfsg-1
+ [trixie] - electrum <not-affected> (Vulnerable code not present, NWC plugin system was introduced in 4.6.0)
+ [bookworm] - electrum <not-affected> (Vulnerable code not present, NWC plugin system was introduced in 4.6.0)
NOTE: https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585
NOTE: Fixed by: https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5 (4.8.0)
NOTE: Fixed by: https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d (4.8.0)
CVE-2026-117602 (Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the ex ...)
- electrum 4.7.2+dfsg-1
+ [trixie] - electrum <not-affected> (Vulnerable code not present, external plugin system was introduced in 4.6.0)
+ [bookworm] - electrum <not-affected> (Vulnerable code not present, external plugin system was introduced in 4.6.0)
NOTE: https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf
NOTE: Fixed by: https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414 (4.7.2)
CVE-2026-117601 (Electrum before 4.8.3 fails to verify signatures of wallet-owned input ...)
@@ -8260,6 +8266,7 @@ CVE-2026-65685
REJECTED
CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS s ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
NOTE: https://cna.erlef.org/cves/CVE-2026-65632.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65632
@@ -8267,6 +8274,7 @@ CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512)
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf (1.11.13)
CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an unauthenti ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-3m45-vrpj-xmrq
NOTE: https://cna.erlef.org/cves/CVE-2026-65631.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65631
@@ -8274,6 +8282,7 @@ CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an unau
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/bfd336c0062bff93e65d08c22361897e96afd956 (1.11.13)
CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad jose allows ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp
NOTE: https://cna.erlef.org/cves/CVE-2026-65630.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65630
@@ -8281,6 +8290,7 @@ CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad jose
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79 (1.11.13)
CVE-2026-65629 (Use of Password Hash With Insufficient Computational Effort in the jos ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc
NOTE: https://cna.erlef.org/cves/CVE-2026-65629.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65629
@@ -8288,6 +8298,7 @@ CVE-2026-65629 (Use of Password Hash With Insufficient Computational Effort in t
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0 (1.11.13)
CVE-2026-65628 (jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/ ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
NOTE: https://cna.erlef.org/cves/CVE-2026-65628.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65628
@@ -8295,6 +8306,7 @@ CVE-2026-65628 (jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_s
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a (1.11.13)
CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
NOTE: https://cna.erlef.org/cves/CVE-2026-65627.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65627
@@ -8302,6 +8314,7 @@ CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data Amplification)
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad (1.11.13)
CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 modu ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-vwvr-f994-6j9j
NOTE: https://cna.erlef.org/cves/CVE-2026-65626.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65626
@@ -8309,6 +8322,7 @@ CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs
NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/0eac8cef9aaa48fb6846f4e47a0002dc4a73966d (1.11.13)
CVE-2026-65625 (The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of ...)
- erlang-jose <unfixed> (bug #1152299)
+ [trixie] - erlang-jose <no-dsa> (Minor issue)
NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6
NOTE: https://cna.erlef.org/cves/CVE-2026-65625.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65625
@@ -38543,9 +38557,11 @@ CVE-2026-93026 (This vulnerability in Veeam Backup & Replication allows a Backup
NOT-FOR-US: Veeam
CVE-2026-92543 (Docker Engine classifies a registry hostname as insecure using an any- ...)
- docker.io <unfixed>
+ [trixie] - docker.io <no-dsa> (Minor issue)
NOTE: https://github.com/moby/moby/security/advisories/GHSA-7cfq-22r6-qp73
CVE-2026-92542 (The firewall rules which mark VXLAN datagrams for encryption indiscrim ...)
- docker.io <unfixed>
+ [trixie] - docker.io <no-dsa> (Minor issue)
NOTE: https://github.com/moby/moby/security/advisories/GHSA-6m9p-4h64-m6vh
CVE-2026-92533 (Path traversal vulnerability in the BugTracker.NET file download compo ...)
NOT-FOR-US: BugTracker.NET
=====================================
data/dsa-needed.txt
=====================================
@@ -23,6 +23,8 @@ amd64-microcode (carnil)
bouncycastle
possibly move to 1.85 for trixie
--
+c-ares
+--
cacti
probably best to move to 1.2.31
--
@@ -171,7 +173,7 @@ social-auth-core
--
squid (aron)
--
-symfony
+symfony (jmm)
Maintainer proposing an update in <e722c4a2-e912-4eb2-a7c5-59035cd24923 at tilapin.org>
--
tomcat10
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec7862a6ea1f9a91309d198366f51c6ddc443e3d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec7862a6ea1f9a91309d198366f51c6ddc443e3d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/eaaef965/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list