[Git][security-tracker-team/security-tracker][master] Add new buildkit issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2aa1672e by Salvatore Bonaccorso at 2026-10-06T09:32:12+02:00
Add new buildkit issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -23,11 +23,17 @@ CVE-2026-94201 (Ash stores :atom-typed attributes as strings and compares them a
 CVE-2026-93617 (Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshin ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93326 (A build step for a Git source, crafted in a specific way, can bypass s ...)
-	TODO: check
+	- golang-github-moby-buildkit <itp> (bug #1094971)
+	NOTE: https://github.com/moby/buildkit/security/advisories/GHSA-66hf-6vf5-87hc
+	TODO: check security impact on docker.io
 CVE-2026-93321 (A malicious frontend can submit an LLB definition that causes buildkit ...)
-	TODO: check
+	- golang-github-moby-buildkit <itp> (bug #1094971)
+	NOTE: https://github.com/moby/buildkit/security/advisories/GHSA-fjj4-h6vf-m9hj
+	TODO: check security impact on docker.io
 CVE-2026-93315 (When proxy networking with CA injection is enabled, a build can modify ...)
-	TODO: check
+	- golang-github-moby-buildkit <itp> (bug #1094971)
+	NOTE: https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x
+	TODO: check security impact on docker.io
 CVE-2026-92821 (A flaw was found in SSSD. When configured to evaluate password expirat ...)
 	TODO: check
 CVE-2026-91107 (openSIS Classic 9.3 allows an authenticated user with the built-in tea ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2aa1672ee132bc17dea882ef67b6f8a021905f66

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2aa1672ee132bc17dea882ef67b6f8a021905f66
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/05cdca99/attachment-0001.htm>