[Git][security-tracker-team/security-tracker][master] Add Debian bug references for wss4j issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cc71d070 by Salvatore Bonaccorso at 2026-10-03T20:57:00+02:00
Add Debian bug references for wss4j issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2537,7 +2537,7 @@ CVE-2026-96342 (Missing Authorization vulnerability in Amauri.IO WPMobile.App wp
 CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 vers ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an oversized allo ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct
 CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 ver ...)
@@ -2623,7 +2623,7 @@ CVE-2026-93462 (A missing authentication for critical function vulnerability exi
 CVE-2026-93460 (A stored cross-site scripting vulnerability via appended strings in em ...)
 	NOT-FOR-US: baserCMS
 CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so  ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
 CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an authentication al ...)
@@ -2650,23 +2650,23 @@ CVE-2026-92867 (An out-of-bounds write vulnerability exists in Pgpool-II , which
 CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin for WordPr ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using the WS ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
 CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
 	NOT-FOR-US: Vaadin
 CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-contro ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
 CVE-2026-88920 (An authentication bypass in the DOM security processor in Apache WSS4J ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9
 CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain relative or ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
 CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
@@ -2674,7 +2674,7 @@ CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker
 CVE-2026-86778 (Observable response discrepancy vulnerability in Maksisoft Technology, ...)
 	NOT-FOR-US: Maksisoft Gym
 CVE-2026-85532 (Apache WSS4J accepted attacker-controlled derived-key lengths and offs ...)
-	- wss4j <unfixed>
+	- wss4j <unfixed> (bug #1149856)
 	[trixie] - wss4j <no-dsa> (Minor issue)
 	NOTE: https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6
 CVE-2026-82307 (Improper neutralization of special elements used in an SQL command ('S ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cc71d0701563de51f650cc017b897de185ac68c5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cc71d0701563de51f650cc017b897de185ac68c5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/ba05292b/attachment.htm>