[Git][security-tracker-team/security-tracker][master] wolfssl: bookworm CVE status from maintainer

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2ddf1c12 by Sylvain Beucler at 2026-10-03T16:29:08+02:00
wolfssl: bookworm CVE status from maintainer

https://lists.debian.org/debian-lts/2026/10/msg00002.html

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -7626,10 +7626,12 @@ CVE-2026-97164 (Joomla Extension - svenbluege.de - Authenticated arbitrary path
 	NOT-FOR-US: Joomla
 CVE-2026-94419 (Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a  ...)
 	- wolfssl <unfixed> (unimportant)
+	[bookworm] - wolfssl <ignored> (built with NO_SESSION_CACHE_REF)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/11500 (v5.9.4-stable)
 	NOTE: built with NO_SESSION_CACHE_REF
 CVE-2026-94418 (Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certi ...)
 	- wolfssl <unfixed> (unimportant)
+	[bookworm] - wolfssl <ignored> (WOLFSSL_SMALL_CERT_VERIFY not built)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/11500 (v5.9.4-stable)
 	NOTE: WOLFSSL_SMALL_CERT_VERIFY not built
 CVE-2026-94417 (When an application enables both OCSP and CRL revocation checking on o ...)
@@ -7647,10 +7649,12 @@ CVE-2026-93302 (MatchTrustedPeer ignores the public key used, leading to forged
 CVE-2026-89136 (When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and ...)
 	- wolfssl <unfixed>
 	[trixie] - wolfssl <no-dsa> (Minor issue)
+	[bookworm] - wolfssl <not-affected> (RPK not in 5.5.4)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/11009 (v5.9.4-stable)
 CVE-2026-89135 (A failed X509_verify_cert call permanently plants an unverified attack ...)
 	- wolfssl <unfixed>
 	[trixie] - wolfssl <not-affected> (Vulnerable code not present, see #1149565)
+	[bookworm] - wolfssl <not-affected> (no WOLFSSL_TEMP_CA path)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/11009 (v5.9.4-stable)
 CVE-2026-89134 (A certificate with no dNSName SAN but another SAN type present (e.g. r ...)
 	- wolfssl <unfixed>
@@ -7659,10 +7663,12 @@ CVE-2026-89134 (A certificate with no dNSName SAN but another SAN type present (
 CVE-2026-89133 (wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certifi ...)
 	- wolfssl <unfixed>
 	[trixie] - wolfssl <no-dsa> (Minor issue)
+	[bookworm] - wolfssl <postponed> (Minor issue; upstream fix changes the layout of the installed struct Signer)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10687 (v5.9.4-stable)
 CVE-2026-89102 (In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side impleme ...)
 	- wolfssl <unfixed>
 	[trixie] - wolfssl <no-dsa> (Minor issue)
+	[bookworm] - wolfssl <not-affected> (no status_request_v2 pending-CA code in 5.5.4)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/11027 (v5.9.4-stable)
 CVE-2026-88778 (Predictable exact value from previous values vulnerability in Citrix N ...)
 	NOT-FOR-US: NetScaler



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ddf1c129876908cc505df90e4bdd87db4246ebf

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ddf1c129876908cc505df90e4bdd87db4246ebf
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/9d546c35/attachment.htm>