[Git][security-tracker-team/security-tracker][master] Add new bouncycastle issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a44bb214 by Salvatore Bonaccorso at 2026-10-03T21:31:34+02:00
Add new bouncycastle issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,5 +1,7 @@
 CVE-2026-97873 (In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy P ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9097873
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/766a31026ac24ed3c6cad8662058ba450c338da1 (r1rv86)
 CVE-2026-96451 (Authorization Bypass Through User-Controlled Key vulnerability in Ulti ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-92767 (The Twenty20 Image Before-After plugin for WordPress is vulnerable to  ...)
@@ -7,23 +9,42 @@ CVE-2026-92767 (The Twenty20 Image Before-After plugin for WordPress is vulnerab
 CVE-2026-92084 (The The Beaver Builder Page Builder \u2013 Drag and Drop Website Build ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-85515 (In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted m ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9085515
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/ab7a235d1c20e3da28ce77167a96b5c14025efa7 (r1rv86)
 CVE-2026-71892 (In Bouncy Castle for Java before 1.86, the opt-in key-size validation  ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071892
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/be0a7d925c818ef2f338bcec55178b9b6336dfc3 (r1rv86)
 CVE-2026-71891 (In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071891
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/c16bcfdce1f96230261b7c2c8c1e044bfc9d1deb (v1rv86)
+	TODO: check, maybe only introduced in 1.85?
 CVE-2026-71890 (In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071890
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/7e8bb10eb90baddf3f10b8679f627462b9522d24 (v1rv86)
 CVE-2026-71889 (In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathRev ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071889
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85 (r1rv86)
 CVE-2026-71888 (In Bouncy Castle for Java before 1.86, the streaming CMS Authenticated ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071888
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/dcb683b32b440f1beb1d2276a34930164281fb95 (r1rv86)
 CVE-2026-71887 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP API acce ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6 (r1rv86)
 CVE-2026-71886 (In Bouncy Castle for Java before 1.86, the high-level OpenPGP certific ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071886
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/f0d5c8535aeff3f34b7b6b6289ee78c2ea36a3fb (r1rv86)
 CVE-2026-71885 (In Bouncy Castle for Java before 1.86, the Messaging Layer Security (M ...)
-	TODO: check
+	- bouncycastle 1.86-1
+	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071885
+	NOTE: Fixed by: https://github.com/bcgit/bc-java/commit/77632a57edf350a7b5751fca1a5052daffa8dab2 (v1rv86)
 CVE-2026-71883 (In Bouncy Castle for Java LTS before 2.73.13, the one-shot native pack ...)
 	TODO: check
 CVE-2026-18040 (In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a44bb214f2fe68dd3ec240137e21dfa7f4488a57

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a44bb214f2fe68dd3ec240137e21dfa7f4488a57
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/e34bc7b9/attachment.htm>