[Git][security-tracker-team/security-tracker][master] 16 commits: lts: python-asteval postponed in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sat Oct 3 23:20:42 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2a64da1c by Utkarsh Gupta at 2026-10-04T03:38:48+05:30
lts: python-asteval postponed in bookworm
- - - - -
da7946f7 by Utkarsh Gupta at 2026-10-04T03:38:49+05:30
lts: python-autobahn postponed in bookworm
- - - - -
8d1b91b4 by Utkarsh Gupta at 2026-10-04T03:38:51+05:30
lts: python-hpack postponed in bookworm
- - - - -
87779e01 by Utkarsh Gupta at 2026-10-04T03:38:53+05:30
lts: qt6-base postponed in bookworm
- - - - -
686f4453 by Utkarsh Gupta at 2026-10-04T03:38:54+05:30
lts: qt6-declarative postponed in bookworm
- - - - -
25eeafb7 by Utkarsh Gupta at 2026-10-04T03:38:56+05:30
lts: qtbase-opensource-src postponed in bookworm
- - - - -
8c2e4371 by Utkarsh Gupta at 2026-10-04T03:38:58+05:30
lts: qtdeclarative-opensource-src postponed in bookworm
- - - - -
effe849a by Utkarsh Gupta at 2026-10-04T03:38:59+05:30
lts: rabbitmq-java-client postponed in bookworm
- - - - -
3d95260b by Utkarsh Gupta at 2026-10-04T03:39:01+05:30
lts: rclone postponed in bookworm
- - - - -
ed20da98 by Utkarsh Gupta at 2026-10-04T03:39:03+05:30
lts: restrictedpython postponed in bookworm
- - - - -
7a2aa6f1 by Utkarsh Gupta at 2026-10-04T03:39:05+05:30
lts: rlottie postponed in bookworm
- - - - -
d67d1023 by Utkarsh Gupta at 2026-10-04T03:39:06+05:30
lts: rpm postponed in bookworm
- - - - -
d0294803 by Utkarsh Gupta at 2026-10-04T03:39:08+05:30
lts: soupsieve postponed in bookworm
- - - - -
f800fc41 by Utkarsh Gupta at 2026-10-04T03:39:10+05:30
lts: sudo postponed in bookworm
- - - - -
d66e318b by Utkarsh Gupta at 2026-10-04T03:39:11+05:30
lts: tftp-hpa postponed in bookworm
- - - - -
462f71df by Utkarsh Gupta at 2026-10-04T03:39:13+05:30
lts: tomcat-native postponed in bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4644,6 +4644,7 @@ CVE-2026-103243 (LightLLM through 1.2.0 fails to validate image_url and audio_ur
CVE-2026-103242 (A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATU ...)
- rpm <unfixed>
[trixie] - rpm <no-dsa> (Minor issue)
+ [bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543866
CVE-2026-103241 (A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerab ...)
- vllm <itp> (bug #1095237)
@@ -11170,10 +11171,12 @@ CVE-2026-95985 (The file write tool in Amazon Kiro IDE versions before 1.0.242 m
CVE-2026-95521 (A command injection flaw was found in rpm. Installing or rebuilding a ...)
- rpm <unfixed>
[trixie] - rpm <no-dsa> (Minor issue)
+ [bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537812
CVE-2026-95519 (A flaw was found in rpm. An attacker can supply a crafted manifest fil ...)
- rpm <unfixed>
[trixie] - rpm <no-dsa> (Minor issue)
+ [bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2470977
CVE-2026-94613 (authentik is an open-source identity provider. Prior to 2026.2.7, 2026 ...)
NOT-FOR-US: authentik
@@ -12846,6 +12849,7 @@ CVE-2026-96513 (A security flaw has been discovered in Neethuharii CafeManagemen
CVE-2026-96512 (A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER ...)
- sudo 1.9.17p2-9 (bug #1148890)
[trixie] - sudo <no-dsa> (Minor issue)
+ [bookworm] - sudo <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/24/4
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2539327
NOTE: Fixed by: https://github.com/sudo-project/sudo/commit/db669167ca599f2a94cd8a4c5fae9e473c81a2fd
@@ -13320,8 +13324,10 @@ CVE-2026-80338 (The CMB2 WordPress plugin before 2.13.0 does not perform any cap
CVE-2026-79616 (Out-of-bounds read while parsing untrusted SVG path strings in Qt Quic ...)
- qt6-declarative 6.11.2+dfsg-3
[trixie] - qt6-declarative <no-dsa> (Minor issue)
+ [bookworm] - qt6-declarative <postponed> (Minor issue)
- qtdeclarative-opensource-src <unfixed>
[trixie] - qtdeclarative-opensource-src <no-dsa> (Minor issue)
+ [bookworm] - qtdeclarative-opensource-src <postponed> (Minor issue)
NOTE: https://codereview.qt-project.org/c/qt/qtdeclarative/+/754718
NOTE: https://github.com/qt/qtdeclarative/commit/34a90737c73d5fb9043367fdf944a553f82f9053 (v6.11.2)
CVE-2026-79310 (webpy web.py 0.76 is vulnerable to server-side template injection (SST ...)
@@ -13335,8 +13341,10 @@ CVE-2026-79304 (CyberPanel 1.9.1 contains a path traversal vulnerability in the
CVE-2026-78253 (Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Gr ...)
- qt6-base 6.11.2+dfsg-5
[trixie] - qt6-base <no-dsa> (Minor issue)
+ [bookworm] - qt6-base <postponed> (Minor issue)
- qtbase-opensource-src <unfixed>
[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
+ [bookworm] - qtbase-opensource-src <postponed> (Minor issue)
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/754345
NOTE: https://github.com/qt/qtbase/commit/50cc08f278c6961d00b5b8bae408d4ccc2fbca4d (dev)
NOTE: https://github.com/qt/qtbase/commit/f91c48650443262db9be37d5239ebe0db18e9555 (v6.11.2)
@@ -13594,6 +13602,7 @@ CVE-2026-59990 (Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse m
CVE-2026-59980 (hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, ...)
- python-hpack <unfixed> (bug #1148944)
[trixie] - python-hpack <no-dsa> (Minor issue)
+ [bookworm] - python-hpack <postponed> (Minor issue)
NOTE: https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2
NOTE: https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c (v4.2.0)
CVE-2026-59167 (SunEditor is a lightweight and powerful WYSIWYG editor in vanilla Java ...)
@@ -13814,18 +13823,21 @@ CVE-2026-XXXX [GHSA-r6xj-6488-p8mv: NTFS-3G-SA_2026-06-1_05]
CVE-2026-86247 (Race condition within a thread vulnerability in Apache Tomcat Native a ...)
- tomcat-native 2.0.16-1
[trixie] - tomcat-native <no-dsa> (Minor issue)
+ [bookworm] - tomcat-native <postponed> (Minor issue)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/fb688de41e837d98e76961e44584b37989e4f7d0 (2.0.16)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/3dc73c118d2202c8dfc6053787cc6d61416ddce6 (1.3.9)
NOTE: https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1
CVE-2026-86246 (Initialization of a resource with an insecure default vulnerability in ...)
- tomcat-native 2.0.16-1
[trixie] - tomcat-native <no-dsa> (Minor issue)
+ [bookworm] - tomcat-native <postponed> (Minor issue)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/f6bb04b28f234a35c21a2997963195ae1d86de69 (2.0.16)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/77a87991079211805f41ddb2c51067bb807dcb40 (1.3.9)
NOTE: https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol
CVE-2026-86243 (Buffer over-read vulnerability in Apache Tomcat Native during the TLS ...)
- tomcat-native 2.0.16-1
[trixie] - tomcat-native <no-dsa> (Minor issue)
+ [bookworm] - tomcat-native <postponed> (Minor issue)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/9a7c804afc05fdc630520eb4012ce1c4ff787862 (2.0.16)
NOTE: Fixed by: https://github.com/apache/tomcat-native/commit/ce019af0db385dfd5bc7c7a759f71602559a0499 (1.3.9)
NOTE: https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
@@ -16525,10 +16537,12 @@ CVE-2026-93988 (QloApps through 1.7.0 contains a path traversal vulnerability in
CVE-2026-93987 (rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnera ...)
- rclone <unfixed> (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
+ [bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6
CVE-2026-93986 (rclone before 1.75.1 fails to confine names from server and third-part ...)
- rclone <unfixed> (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
+ [bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q
CVE-2026-93985 (OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerabi ...)
NOT-FOR-US: OpenPanel
@@ -16903,6 +16917,7 @@ CVE-2026-77820 (The WPComplete plugin for WordPress is vulnerable to Stored Cros
CVE-2026-77528 (Autobahn Python is a WebSocket and WAMP implementation for Python that ...)
- python-autobahn <unfixed>
[trixie] - python-autobahn <no-dsa> (Minor issue)
+ [bookworm] - python-autobahn <postponed> (Minor issue)
NOTE: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
NOTE: https://github.com/crossbario/autobahn-python/pull/1916
NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613 (v26.7.1)
@@ -18695,11 +18710,13 @@ CVE-2026-86038 (libp2p is a JavaScript implementation of the libp2p networking s
CVE-2026-86000 (Soup Sieve is a CSS selector library designed to be used with Beautifu ...)
- soupsieve <unfixed> (bug #1148449)
[trixie] - soupsieve <no-dsa> (Minor issue)
+ [bookworm] - soupsieve <postponed> (Minor issue)
NOTE: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c
NOTE: Fixed by: https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef (2.9)
CVE-2026-85999 (Soup Sieve is a CSS selector library designed to be used with Beautifu ...)
- soupsieve <unfixed> (bug #1148449)
[trixie] - soupsieve <no-dsa> (Minor issue)
+ [bookworm] - soupsieve <postponed> (Minor issue)
NOTE: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f
NOTE: Fixed by: https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda (2.9)
CVE-2026-85721 (The AsyncHttpClient (AHC) library allows Java applications to easily e ...)
@@ -23932,6 +23949,7 @@ CVE-2026-76852 (Netcore NR268 firmware version 1.7.121109 has an improper integr
CVE-2026-76825 (RestrictedPython is a tool that helps define a subset of the Python la ...)
- restrictedpython 8.4-1
[trixie] - restrictedpython <no-dsa> (Minor issue)
+ [bookworm] - restrictedpython <postponed> (Minor issue)
NOTE: https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-hp3v-5vw7-fx9w
NOTE: Fixed by: https://github.com/zopefoundation/RestrictedPython/commit/3b47440070b91f8807c2b2998aca99e94783639a (8.4)
CVE-2026-76821 (OpenCTI is an open source platform for managing cyber threat intellige ...)
@@ -24043,6 +24061,7 @@ CVE-2026-76186 (Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak
CVE-2026-76151 (Out-of-bounds read (buffer over-read) in the HTTP Cache-Control respon ...)
- qt6-base 6.11.2+dfsg-5
[trixie] - qt6-base <no-dsa> (Minor issue)
+ [bookworm] - qt6-base <postponed> (Minor issue)
- qtbase-opensource-src <not-affected> (Specific to Qt6)
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/752129
CVE-2026-76104 (Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Per ...)
@@ -24050,6 +24069,7 @@ CVE-2026-76104 (Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorre
CVE-2026-75516 (The RabbitMQ Java client library allows Java and JVM-based application ...)
- rabbitmq-java-client <unfixed> (bug #1149675)
[trixie] - rabbitmq-java-client <no-dsa> (Minor issue)
+ [bookworm] - rabbitmq-java-client <postponed> (Minor issue)
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/pull/2015
NOTE: Fixed by: https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e (main)
@@ -26120,6 +26140,7 @@ CVE-2026-91835 (A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. T
CVE-2026-91826 (Stack-based buffer overflow vulnerability in Samsung Opensource rLotti ...)
- rlottie <unfixed>
[trixie] - rlottie <no-dsa> (Minor issue)
+ [bookworm] - rlottie <postponed> (Minor issue)
NOTE: https://github.com/Samsung/rlottie/pull/607
NOTE: Fixed by: https://github.com/Samsung/rlottie/commit/480a2ad0c5d2e45458c545b8213279e9e8b71e39
CVE-2026-91825 (Affected versions of MISP fail to authorize a submitted sharing group ...)
@@ -26214,6 +26235,7 @@ CVE-2026-86472 (fast-uri is a dependency-free RFC 3986 URI parser for Node.js, u
CVE-2026-85234 (A flaw was found in tftp-hpa. When the `in.tftpd` remap engine process ...)
- tftp-hpa 5.3+20251116-1
[trixie] - tftp-hpa <no-dsa> (Minor issue)
+ [bookworm] - tftp-hpa <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460997
NOTE: https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=4b493532f5ce052a1c124acd0661233ec7918327 (tftp-hpa-5.4)
CVE-2026-82837 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
@@ -28071,6 +28093,7 @@ CVE-2026-64701 (A permissions issue was addressed with additional restrictions.
CVE-2026-55244 (ASTEVAL is an evaluator of Python expressions and statements. Prior to ...)
- python-asteval <unfixed> (bug #1148447)
[trixie] - python-asteval <no-dsa> (Minor issue)
+ [bookworm] - python-asteval <postponed> (Minor issue)
NOTE: https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77
NOTE: https://github.com/lmfit/asteval/pull/153
NOTE: Fixed by: https://github.com/lmfit/asteval/commit/9c625b3674f8d05f206708bb85afca17a87694a4 (1.0.9)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/071188754c10adda11cfb6aca472ed21545fba3d...462f71dfee8101c262667cec77b94df43c7a638b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/071188754c10adda11cfb6aca472ed21545fba3d...462f71dfee8101c262667cec77b94df43c7a638b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/6e17f1ab/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list