[Git][security-tracker-team/security-tracker][master] auto-nfu: Update wikimedia rule

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2bc0fe82 by Moritz Muehlenhoff at 2026-10-01T09:21:46+02:00
auto-nfu: Update wikimedia rule

- - - - -


2 changed files:

- data/CVE/list
- data/packages/nfu.yaml


Changes:

=====================================
data/CVE/list
=====================================
@@ -1055,7 +1055,7 @@ CVE-2026-103445 (Improper neutralization of Script-Related HTML tags in a web pa
 CVE-2026-103444 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103443 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103442 (External control of system or configuration setting vulnerability in T ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103441 (Deserialization of untrusted data vulnerability in The Wikimedia Found ...)
@@ -1063,11 +1063,11 @@ CVE-2026-103441 (Deserialization of untrusted data vulnerability in The Wikimedi
 CVE-2026-103440 (Exposure of sensitive information through data queries vulnerability i ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103439 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103438 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103437 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103436 (apcupsd through 3.14.14 discloses uninitialized stack memory in getups ...)
 	- apcupsd <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2493140
@@ -1584,21 +1584,21 @@ CVE-2026-103054 (AiSOC versions before 12.0.0 contain an authorization bypass vu
 CVE-2026-103053 (AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on t ...)
 	NOT-FOR-US: AiSOC
 CVE-2026-103051 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103050 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103049 (Improper neutralization of input during web page generation ('cross-si ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103048 (URL redirection to untrusted site ('open redirect') vulnerability in T ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103047 (Improper neutralization of input during web page generation ('cross-si ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103046 (Improper neutralization of input during web page generation ('cross-si ...)
 	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103045 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in The Wikimed ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-103043 (anchorme through 3.0.8 contains a regular expression denial of service ...)
 	NOT-FOR-US: anchorme Node.js module
 CVE-2026-103042 (LightLLM through 1.2.0 contains a memory exhaustion vulnerability in t ...)


=====================================
data/packages/nfu.yaml
=====================================
@@ -968,11 +968,14 @@
       - product: '.*CampaignEvents.*'
       - product: '.*Cargo.*'
       - product: '.*CentralAuth.*'
+      - product: '.*CentralNotice.*'
       - product: '.*Charts.*'
       - product: '.*CheckUser.*'
       - product: '.*CirrusSearch.*'
+      - product: '.*Collection.*'
       - product: '.*CookieConsent.*'
       - product: '.*DataTransfer.*'
+      - product: '.*EasyTimeline.*'
       - product: '.*EventBus.*'
       - product: '.*ExternalData.*'
       - product: '.*ExternalGuidance.*'
@@ -984,6 +987,7 @@
       - product: '.*LanguageSelector.*'
       - product: '.*LastModified.*'
       - product: '.*Lockdown.*'
+      - product: '.*MassMessage.*'
       - product: '.*Monaco.*'
       - product: '.*OAuth.*'
       - product: '.*PageForms.*'
@@ -991,6 +995,8 @@
       - product: '.*PageTriage.*'
       - product: '.*ProofreadPage.*'
       - product: '.*RedirectManager.*'
+      - product: '.*ReadingLists.*'
+      - product: '.*Refreshed.*'
       - product: '.*ReportIncident.*'
       - product: '.*Score.*'
       - product: '.*TemplateSandbox.*'
@@ -1009,7 +1015,6 @@
       - product: '.*Wikilove.*'
       - product: '.*Wikistories.*'
       - product: Wikipedia Android App
-      - product: timeline
 # Description based rules
 - reason: Advantech
   description: '.*\bAdvantech\b.*'



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bc0fe82958dc895e4a853f6dd5b5091fba7286b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bc0fe82958dc895e4a853f6dd5b5091fba7286b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/24d00351/attachment-0001.htm>