[Git][security-tracker-team/security-tracker][master] rails, ruby-jwt DSAs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 6 20:54:20 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
72c03456 by Moritz Mühlenhoff at 2026-10-06T21:50:47+02:00
rails, ruby-jwt DSAs
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -178171,7 +178171,6 @@ CVE-2026-33661 (Pay is an open-source payment SDK extension package for various
NOT-FOR-US: Pay
CVE-2026-33658 (Active Storage allows users to attach cloud and local files in Rails a ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
@@ -181802,7 +181801,6 @@ CVE-2026-33211 (Tekton Pipelines project provides k8s-style resources for declar
NOT-FOR-US: Tekton Pipelines project
CVE-2026-33202 (Active Storage allows users to attach cloud and local files in Rails a ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
@@ -181811,7 +181809,6 @@ CVE-2026-33202 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 (v7.2.3.1)
CVE-2026-33195 (Active Storage allows users to attach cloud and local files in Rails a ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
@@ -181820,7 +181817,6 @@ CVE-2026-33195 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c (v7.2.3.1)
CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
@@ -181829,7 +181825,6 @@ CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core e
NOTE: Fixed by: https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a (v7.2.3.1)
CVE-2026-33174 (Active Storage allows users to attach cloud and local files in Rails a ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
@@ -181838,7 +181833,6 @@ CVE-2026-33174 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b (v7.2.3.1)
CVE-2026-33173 (Active Storage allows users to attach cloud and local files in Rails a ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, automatic content type bypass)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
@@ -181847,7 +181841,6 @@ CVE-2026-33173 (Active Storage allows users to attach cloud and local files in R
NOTE: Fixed by: https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 (v7.2.3.1)
CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
@@ -181856,7 +181849,6 @@ CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core e
NOTE: Fixed by: https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb (v7.2.3.1)
CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
@@ -181865,7 +181857,6 @@ CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core e
NOTE: Fixed by: https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 (v7.2.3.1)
CVE-2026-33168 (Action View provides conventions and helpers for building web pages wi ...)
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [trixie] - rails <no-dsa> (Minor issue)
[bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,9 @@
+[06 Oct 2026] DSA-6547-1 ruby-jwt - security update
+ {CVE-2026-45363}
+ [trixie] - ruby-jwt 2.7.1-1+deb13u1
+[06 Oct 2026] DSA-6546-1 rails - security update
+ {CVE-2026-33168 CVE-2026-33169 CVE-2026-33170 CVE-2026-33173 CVE-2026-33174 CVE-2026-33176 CVE-2026-33195 CVE-2026-33202 CVE-2026-33658 CVE-2026-66066}
+ [trixie] - rails 2:7.2.2.2+dfsg-2~deb13u2
[06 Oct 2026] DSA-6545-1 roundcube - security update
[trixie] - roundcube 1.6.19+dfsg-0+deb13u1
[05 Oct 2026] DSA-6544-1 sabnzbdplus - security update
=====================================
data/dsa-needed.txt
=====================================
@@ -153,17 +153,11 @@ python-msgpack
rabbitmq-server
Thomas Goirand proposed debdiff in <fcd06061-8e0d-483e-ab92-379b58b2b82d at debian.org>
--
-rails
- Simon Quigley is proposing an update for trixie-security, <b2523fff-aae4-490f-a017-9b13b05d99c2 at tsimonq2.net>
---
rtpengine
Victor Seva prepared a debdiff for trixie-security for review, bookworm-security debdiff missing
--
ruby3.3
--
-ruby-jwt (jmm)
- Abhijith PA proposing a debdiff for review in <artAyF844xTte2A- at debian.org>
---
runc
--
rust-wasmtime
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72c03456e55daf67a00ff2896f4a9a7f13b3eb40
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72c03456e55daf67a00ff2896f4a9a7f13b3eb40
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/083ec258/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list