[Git][security-tracker-team/security-tracker][master] Track fixes for rust-russh via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 06:25:43 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
60f33ea6 by Salvatore Bonaccorso at 2026-10-07T07:25:07+02:00
Track fixes for rust-russh via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -8970,27 +8970,27 @@ CVE-2026-102827 (simple-git, an interface for running git commands in any node.j
CVE-2026-102826 (simple-git, an interface for running git commands in any node.js appli ...)
NOT-FOR-US: simple-git
CVE-2026-102825 (Russh is a Rust SSH client and server library. Prior to 0.62.6, the US ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/f8fd0b11a393364dc7f01a182482d86adafdd653 (v0.62.6)
CVE-2026-102824 (Russh is a Rust SSH client and server library. Prior to 0.63.0, the hy ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-w3jg-pjxf-73p4
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/8da8967f196472576b1565d518a0ed60fce60f0c (v0.63.0)
CVE-2026-102823 (Russh is a Rust SSH client and server library. Prior to 0.63.1, client ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/3430fd26ecafc0dc3705210f5f39a9119fa22774 (v0.63.1)
CVE-2026-102822 (Russh is a Rust SSH client and server library. Prior to 0.63.1, a conn ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/2885385abfee279092a41d80c6cb6ac367353159 (v0.63.1)
CVE-2026-102821 (Russh is a Rust SSH client and server library. Prior to 0.63.2, an aut ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-35g8-35p8-c8fw
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/a282af361ac99bc76b80876d1aae128e89dbf66b (v0.63.2)
CVE-2026-102820 (pageant provides a [PageantStream] type that implements [AsyncRead] an ...)
- - rust-russh <unfixed> (bug #1149646)
+ - rust-russh 0.64.1-1 (bug #1149646)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b (v0.63.2)
CVE-2026-102811 (Marmite through 0.4.2 contains missing authentication in the developme ...)
@@ -71270,7 +71270,7 @@ CVE-2026-73531 (django-helpdesk before 2.3.3 contains a stored cross-site script
CVE-2026-73530 (Flyto2 Core before 2.28.0 contains a server-side request forgery guard ...)
NOT-FOR-US: Flyto2 Core
CVE-2026-73489 (Russh is a Rust SSH client & server library. Prior to 0.62.4, an authe ...)
- - rust-russh <unfixed> (bug #1144400)
+ - rust-russh 0.64.1-1 (bug #1144400)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-cqjc-rmpq-xprq
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/8912512371820167a12a0a638bd666856ce458ad (v0.62.4)
CVE-2026-73480 (gdu fails to strip terminal escape sequences from directory and file n ...)
@@ -72852,11 +72852,11 @@ CVE-2026-73433 (A flaw was found in GStreamer gst-plugins-good (avidemux). When
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c429d2a33496b54b8e6c00dbf1fdc4e3f52d8481 (1.26.8)
NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0072.html
CVE-2026-73430 (Russh is a Rust SSH client & server library. Prior to 0.62.4, an unaut ...)
- - rust-russh <unfixed> (bug #1144347)
+ - rust-russh 0.64.1-1 (bug #1144347)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-5xvq-cp9x-6p6r
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/a7fc1eb5717264e31c3c5f7dd849b73989a08f3d (v0.62.4)
CVE-2026-73429 (Russh is a Rust SSH client & server library. Prior to 0.62.4, a malici ...)
- - rust-russh <unfixed> (bug #1144347)
+ - rust-russh 0.64.1-1 (bug #1144347)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-g9hv-x236-4qp3
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/a7fc1eb5717264e31c3c5f7dd849b73989a08f3d (v0.62.4)
CVE-2026-73427 (Trix is a what-you-see-is-what-you-get rich text editor for everyday w ...)
@@ -83610,7 +83610,7 @@ CVE-2026-69075 (FlowIntel is affected by a stored cross-site scripting vulnerabi
CVE-2026-68945 (Angular is a development platform for building mobile and desktop web ...)
- angular.js <unfixed>
CVE-2026-68930 (Russh is a Rust SSH client & server library. Prior to 0.62.5, russh di ...)
- - rust-russh <unfixed> (bug #1143601)
+ - rust-russh 0.64.1-1 (bug #1143601)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/7c5659f8cf6f6f2f9989d12dba0ebf49dc50a171 (v0.62.5)
CVE-2026-68869
@@ -128482,13 +128482,13 @@ CVE-2026-48547 (KanaDojo contains a command injection vulnerability that allows
CVE-2026-48546 (KanaDojo before 0.1.18 contains a sandbox escape vulnerability that al ...)
NOT-FOR-US: KanaDojo
CVE-2026-48110 (Russh is a Rust SSH client & server library. From version 0.34.0 to be ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-4r3c-5hpg-58qr
CVE-2026-48108 (Russh is a Rust SSH client & server library. From version 0.34.0-beta. ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-76r6-x97p-67vr
CVE-2026-48107 (Russh is a Rust SSH client & server library. From version 0.37.0 to be ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-g9g7-5cgw-6v28
CVE-2026-48011 (Shopware is an open commerce platform. Prior to versions 6.6.10.18 and ...)
NOT-FOR-US: Shopware
@@ -128535,12 +128535,12 @@ CVE-2026-47162 (Vim is an open source, command line text editor. Prior to versio
CVE-2026-47157 (aiograpi is an asynchronous Instagram API for Python. aiograpi version ...)
NOT-FOR-US: aiograpi
CVE-2026-46705 (Russh is a Rust SSH client & server library. From version 0.34.0-beta. ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-hpv4-5h6f-wqr3
CVE-2026-46703 (Boxlite is a sandbox service that allows users to create lightweight v ...)
NOT-FOR-US: Boxlite
CVE-2026-46702 (Russh is a Rust SSH client & server library. From version 0.34.0 to be ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259
CVE-2026-46698 (Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to v ...)
NOT-FOR-US: Fediverse Embeds
@@ -128555,7 +128555,7 @@ CVE-2026-46683 (Snappy is a PHP library allowing thumbnail, snapshot or PDF gene
CVE-2026-46679 (libp2p is a JavaScript Implementation of libp2p networking stack. Prio ...)
NOT-FOR-US: Node libp2p
CVE-2026-46673 (Russh is a Rust SSH client & server library. Prior to version 0.60.3, ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
- rust-russh-cryptovec 0.62.0-1
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5
CVE-2026-46669 (OpenVM is a performant and modular zkVM framework built for customizat ...)
@@ -152596,7 +152596,7 @@ CVE-2026-42192 (Plunk is an open-source email platform built on top of AWS SES.
CVE-2026-42190 (RedwoodSDK is a server-first React framework. From version 1.0.0-beta. ...)
NOT-FOR-US: RedwoodSDK
CVE-2026-42189 (Russh is a Rust SSH client & server library. Prior to version 0.60.1, ...)
- - rust-russh <unfixed> (bug #1139726)
+ - rust-russh 0.64.1-1 (bug #1139726)
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1 (v0.60.1)
CVE-2026-42185 (People is an application to handle users and teams, and distribute per ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60f33ea624b17e75e959b224a4ce0829e6ff3d63
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60f33ea624b17e75e959b224a4ce0829e6ff3d63
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/94b5c58b/attachment.htm>
More information about the debian-security-tracker-commits
mailing list