[Git][security-tracker-team/security-tracker][master] 4 commits: lts: node-axios not-affected in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Mon Oct 5 02:37:41 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ad471416 by Utkarsh Gupta at 2026-10-05T02:58:51+05:30
lts: node-axios not-affected in bookworm
- - - - -
f91cfbb7 by Utkarsh Gupta at 2026-10-05T03:06:59+05:30
lts: triage wss4j in bookworm
- - - - -
e1d0d34d by Utkarsh Gupta at 2026-10-05T03:09:49+05:30
lts: rclone not-affected in bookworm
- - - - -
2d87c7eb by Utkarsh Gupta at 2026-10-05T03:14:14+05:30
dla-needed: add social-auth-core
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -2769,6 +2769,7 @@ CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.
CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an oversized allo ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct
CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 ver ...)
NOT-FOR-US: WordPress plugin or theme
@@ -2855,6 +2856,7 @@ CVE-2026-93460 (A stored cross-site scripting vulnerability via appended strings
CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an authentication al ...)
- pgpool2 4.7.3-1 (bug #1149670)
@@ -2882,22 +2884,26 @@ CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin for
CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using the WS ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <not-affected> (Vulnerable StAX code introduced in 2.0)
NOTE: https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
NOT-FOR-US: Vaadin
CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-contro ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
CVE-2026-88920 (An authentication bypass in the DOM security processor in Apache WSS4J ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <ignored> (SAML support not built in Debian)
NOTE: https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9
CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
NOT-FOR-US: WordPress plugin
CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain relative or ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <not-affected> (Vulnerable StAX code introduced in 2.0)
NOTE: https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
NOT-FOR-US: Tugtainer
@@ -2906,6 +2912,7 @@ CVE-2026-86778 (Observable response discrepancy vulnerability in Maksisoft Techn
CVE-2026-85532 (Apache WSS4J accepted attacker-controlled derived-key lengths and offs ...)
- wss4j <unfixed> (bug #1149856)
[trixie] - wss4j <no-dsa> (Minor issue)
+ [bookworm] - wss4j <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6
CVE-2026-82307 (Improper neutralization of special elements used in an SQL command ('S ...)
NOT-FOR-US: SOPLOG
@@ -7578,6 +7585,7 @@ CVE-2026-101900 (Axios is a promise-based HTTP client for the browser and Node.j
CVE-2026-101898 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, HTTP/2 support introduced in 1.13.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
@@ -33026,6 +33034,7 @@ CVE-2026-88021 (Consul and Consul Enterprise are vulnerable to an authorization
CVE-2026-88018 (rclone is a command-line program to sync files and directories to and ...)
- rclone <unfixed> (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
+ [bookworm] - rclone <not-affected> (Vulnerable code not present, only affects 1.68 and later)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
NOTE: Fixed by: https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd (1.75.1)
CVE-2026-88017 (rclone is a command-line program to sync files and directories to and ...)
=====================================
data/dla-needed.txt
=====================================
@@ -753,6 +753,18 @@ snapd
NOTE: 20260726: in 2.71-1. Entry was bullseye-only as bookworm was not yet
NOTE: 20260726: LTS when it was filed in 2026-03. (utkarsh/front-desk)
--
+social-auth-core
+ NOTE: 20261004: Added by Front-Desk (utkarsh)
+ NOTE: 20261004: Upcoming DSA (in dsa-needed). CVE-2026-57175..57179 (fixed in
+ NOTE: 20261004: 5.0.0) are all present in 4.3.0, but every one needs an opt-in
+ NOTE: 20261004: backend or pipeline step (SAML, Vend, LoginRadius, vk-app,
+ NOTE: 20261004: partial/mail validation). CVE-2026-57178's fix is incomplete
+ NOTE: 20261004: without c0b4ecc (5.1.1, GHSA-8hrj-gg7r-fxg9); CVE-2026-57179's
+ NOTE: 20261004: fix breaks the API (needs social-auth-app-django hooks).
+ NOTE: 20261004: Double-check whether a DLA is really warranted: utkarsh would
+ NOTE: 20261004: drop it (not sponsored, opt-in backends only), but another
+ NOTE: 20261004: pair of eyes would be good. (utkarsh/front-desk)
+--
sogo
NOTE: 20260904: Added by Front-Desk (pochu)
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ba4f61f373713bcae6916a724ff3a63a9f10654c...2d87c7eb3718c7377d24f3a5e461caf7c3d7d88a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ba4f61f373713bcae6916a724ff3a63a9f10654c...2d87c7eb3718c7377d24f3a5e461caf7c3d7d88a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/37f7a9b2/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list