[Git][security-tracker-team/security-tracker][master] 3 commits: lts: mark CVE-2026-54275/python-aiohttp as not affecting Bookworm

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d03b9910 by Daniel Leidert at 2026-10-02T08:30:52+02:00
lts: mark CVE-2026-54275/python-aiohttp as not affecting Bookworm

- - - - -
a4308cd4 by Daniel Leidert at 2026-10-02T08:30:53+02:00
lts: mark CVE-2026-69244/python-aiohttp as not affecting Bookworm

- - - - -
222695b4 by Daniel Leidert at 2026-10-02T08:31:31+02:00
Reserve DLA-4813-1 for open-iscsi

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -78020,6 +78020,8 @@ CVE-2026-69245 (Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0
 CVE-2026-69244 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	- python-aiohttp 3.14.3-1 (bug #1143597)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
+	[bookworm] - python-aiohttp <not-affected> (Vulnerable code introduced later)
+	[bullseye] - python-aiohttp <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273
 	NOTE: https://github.com/aio-libs/aiohttp/pull/13223
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d (v3.14.3)
@@ -117265,6 +117267,8 @@ CVE-2026-54276 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 CVE-2026-54275 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	- python-aiohttp 3.14.1-1
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
+	[bookworm] - python-aiohttp <not-affected> (Vulnerable code not present)
+	[bullseye] - python-aiohttp <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0 (v3.14.1)
 CVE-2026-54274 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[02 Oct 2026] DLA-4813-1 open-iscsi - security update
+	{CVE-2026-18724 CVE-2026-18725 CVE-2026-18726 CVE-2026-18727 CVE-2026-18728 CVE-2026-44943 CVE-2026-44944}
+	[bookworm] - open-iscsi 2.1.8-1+deb12u1
 [02 Oct 2026] DLA-4812-1 libio-compress-perl - security update
 	{CVE-2025-15649 CVE-2026-48959 CVE-2026-48962}
 	[bookworm] - libio-compress-perl 2.204-1+deb12u1


=====================================
data/dla-needed.txt
=====================================
@@ -500,9 +500,6 @@ ntfs-3g
   NOTE: 20260716: Added by Front-Desk (Beuc)
   NOTE: 20260716: Follow DSA-6389-1 (9 CVEs) (Beuc/front-desk)
 --
-open-iscsi (dleidert)
-  NOTE: 20260802: Added by Front-Desk (ta)
---
 openexr
   NOTE: 20260413: Added by Front-Desk (rouca)
   NOTE: 20260713: Also add for bookworm (Beuc/front-desk)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b4a2f7d027800c05216f2d90a595348643382856...222695b42bd0c5d98a3f9507364ea2b15cb98bf5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b4a2f7d027800c05216f2d90a595348643382856...222695b42bd0c5d98a3f9507364ea2b15cb98bf5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/15f0e509/attachment-0001.htm>