[Git][security-tracker-team/security-tracker][master] trapperkeeper-authorization-clojure, puppet-agent DSAs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b66e1424 by Moritz Mühlenhoff at 2026-11-04T20:04:36+01:00
trapperkeeper-authorization-clojure, puppet-agent DSAs

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -1741,12 +1741,14 @@ CVE-2026-18375
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2508684
 CVE-2026-XXXX [GHSA-q4hm-33rc-572g: Flawed Hostname Check allows Puppet Client Impersonation]
 	- trapperkeeper-authorization-clojure <unfixed>
+	[trixie] - trapperkeeper-authorization-clojure 2.0.1-2+deb13u1
 	NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/14
 	NOTE: https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g
 	NOTE: Openvox patches: https://github.com/overlookinfra/openvox-security-patches/blob/main/patches/GHSA-q4hm-33rc-572g-Flawed-Hostname-Check-allows-Puppet-Client-Impersonation.patch
 CVE-2026-XXXX [GHSA-ffr6-rwpm-p5wq: Authenticated RCE on OpenVox server via Event Deserialization]
 	- openvox <unfixed>
 	- puppet-agent <removed>
+	[trixie] - puppet-agent 8.10.0-5+deb13u1
 	NOTE: https://www.openwall.com/lists/oss-security/2026/11/03/14
 	NOTE: https://github.com/OpenVoxProject/openvox/security/advisories/GHSA-ffr6-rwpm-p5wq
 	NOTE: Openvox patches: https://github.com/overlookinfra/openvox-security-patches/blob/main/patches/GHSA-ffr6-rwpm-p5wq-Authenticated-RCE-on-Puppet-server-via-Event-Deserialization.patch


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,7 @@
+[04 Nov 2026] DSA-6609-1 trapperkeeper-authorization-clojure - security update
+	[trixie] - trapperkeeper-authorization-clojure 2.0.1-2+deb13u1
+[04 Nov 2026] DSA-6608-1 puppet-agent - security update
+	[trixie] - puppet-agent 8.10.0-5+deb13u1
 [04 Nov 2026] DSA-6607-1 apt - security update
 	{CVE-2026-109518}
 	[trixie] - apt 3.0.4


=====================================
data/dsa-needed.txt
=====================================
@@ -137,8 +137,6 @@ podman
 --
 prometheus
 --
-puppet-agent (jmm)
---
 py7zr
 --
 python-authlib
@@ -176,8 +174,6 @@ tomcat10
 --
 tomcat11
 --
-trapperkeeper-authorization-clojure (jmm)
---
 weechat
   Upstream recommends to use branch from https://github.com/weechat/weechat/commits/4.6/, cf #1142597
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b66e142491cdf9392ae9bee239fdf718517ea38d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b66e142491cdf9392ae9bee239fdf718517ea38d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/43eafed0/attachment-0001.htm>