[Git][security-tracker-team/security-tracker][master] auto-nfu: Add rule for nlnet labs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fd3b99da by Moritz Muehlenhoff at 2026-11-04T14:12:44+01:00
auto-nfu: Add rule for nlnet labs

- - - - -


2 changed files:

- data/CVE/list
- data/packages/nfu.yaml


Changes:

=====================================
data/CVE/list
=====================================
@@ -751,9 +751,9 @@ CVE-2026-120678 (A memory management flaw in the MongoDB C Driver's handling of
 	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/e4394fb21880d360ab6b36855353a455d2127a2f (2.5.8)
 	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/40733d2100cbed890008042e8bb8ab80c8f9249f (1.30.15)
 CVE-2026-120673 (A component of the MongoDB Rust Driver that records diagnostic tracing ...)
-	TODO: check
+	NOT-FOR-US: MongoDB
 CVE-2026-120567 (The MongoDB Entity Framework Core provider does not neutralize special ...)
-	TODO: check
+	NOT-FOR-US: MongoDB
 CVE-2026-120333 (The actions linked in the emails of the extension (e.g. to confirm a r ...)
 	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-120332 (The HTML content of mails and tracked URLs are rendered unescaped in t ...)
@@ -808,7 +808,7 @@ CVE-2026-119485 (Missing Authorization vulnerability in weDevs Dokan dokan-lite
 CVE-2026-119215 (Authorization Bypass Through User-Controlled Key vulnerability in team ...)
 	TODO: check
 CVE-2026-119179 (A flaw in the connection management layer of the MongoDB Node.js drive ...)
-	TODO: check
+	NOT-FOR-US: MongoDB
 CVE-2026-119084 (Unsafe reflection in the connection parameter and credentials profile  ...)
 	NOT-FOR-US: Amazon
 CVE-2026-118983 (The VikWidgetsLoader  WordPress plugin before 1.12.3 does not sanitise ...)
@@ -2500,11 +2500,11 @@ CVE-2026-111048 (FOSSBilling is an open source billing and client-management pla
 CVE-2026-110535 (Improper Privilege Management vulnerability in Apache Syncope.    Auth ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-109142 (When a CA's parent lives on the same Krill server: instead of building ...)
-	TODO: check
+	NOT-FOR-US: NLnet Labs software not packaged in Debian
 CVE-2026-109141 (The vulnerability gives a role that is restricted to a list of CAs (ca ...)
-	TODO: check
+	NOT-FOR-US: NLnet Labs software not packaged in Debian
 CVE-2026-109140 (The vulnerability is that Krill encrypts every login-session token wit ...)
-	TODO: check
+	NOT-FOR-US: NLnet Labs software not packaged in Debian
 CVE-2026-109083 (Improper isolation or compartmentalization vulnerability in Apache Syn ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-107457 (A memory corruption vulnerability in the QMqttClient class of the Qt M ...)


=====================================
data/packages/nfu.yaml
=====================================
@@ -709,6 +709,11 @@
       - product: PRI Driver software
       - product: SigTest
       - product: System Event Log Viewer Utility software
+- reason: NLnet Labs software not packaged in Debian
+  allOf:
+    - cna: "NLnet Labs"
+    - anyOf:
+      - product: Krill
 - reason: Nozomi Networks
   allOf:
     - cna: Nozomi



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fd3b99dac1f4180799b615d7f92ca73030168200

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fd3b99dac1f4180799b615d7f92ca73030168200
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/1af9dd1a/attachment-0001.htm>