[Git][security-tracker-team/security-tracker][master] new rebar3 issue

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d744e8c3 by Moritz Muehlenhoff at 2026-11-04T20:39:19+01:00
new rebar3 issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4076,7 +4076,14 @@ CVE-2026-118070 (The Welcart e-Commerce plugin for WordPress is vulnerable to St
 CVE-2026-118043 (The Bulk Media Register WordPress plugin before 2.01 does not properly ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-117666 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
-	TODO: check
+	- rebar3 <unfixed>
+	NOTE: rebar3 bundles ssl_verify_fun 1.1.6
+	NOTE: https://github.com/deadtrickster/ssl_verify_fun.erl/security/advisories/GHSA-7gw2-hphm-c5px
+	NOTE: https://cna.erlef.org/cves/CVE-2026-117666.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-117666
+	NOTE: https://github.com/deadtrickster/ssl_verify_fun.erl/pull/33
+	NOTE: Introduced by: https://github.com/deadtrickster/ssl_verify_fun.erl/commit/a49ca56923356c7a3981692b23c42ef32c2990e0 (1.0.1)
+	NOTE: Fixed: https://github.com/deadtrickster/ssl_verify_fun.erl/commit/ca34031299cd2e0c98794c0da4ba556b94e39aad (1.1.8)
 CVE-2026-117656 (Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilit ...)
 	NOT-FOR-US: Erlang Foundation software not packaged in Debian
 CVE-2026-117645 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d744e8c3332a00bdfaf6a744387c057f5404db0a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d744e8c3332a00bdfaf6a744387c057f5404db0a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/866f2de5/attachment.htm>