[Git][security-tracker-team/security-tracker][master] Reserve DLA-4827-1 for python3.11
Andrej Shadura (@andrewsh)
andrewsh at debian.org
Thu Oct 8 07:57:59 BST 2026
Andrej Shadura pushed to branch master at Debian Security Tracker / security-tracker
Commits:
1cfd7b59 by Andrej Shadura at 2026-10-08T08:57:21+02:00
Reserve DLA-4827-1 for python3.11
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -108902,7 +108902,6 @@ CVE-2026-15308 (The incremental HTML parser (html.parser.HTMLParser) allows for
- python3.13 3.13.15-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- [bookworm] - python3.11 <postponed> (CPU-only DoS; the quadratic rescan needs feed() driven in small chunks, a single feed() of the whole document stays linear; no upstream fix for this branch)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (CPU-only DoS; the quadratic rescan needs feed() driven in small chunks, a single feed() of the whole document stays linear; no upstream fix for this branch)
- python2.7 <removed>
@@ -132607,7 +132606,6 @@ CVE-2026-9669 (bz2.BZ2Decompressor objects could be reused after a decompression
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/150599
@@ -136620,7 +136618,6 @@ CVE-2026-3276 (unicodedata.normalize() can take excessive CPU time when processi
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue)
- python2.7 <removed>
@@ -150147,7 +150144,6 @@ CVE-2026-8328 (The ftpcp() function in Lib/ftplib.py was not updated when CVE-2
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue, port scanning in specific scenario)
- python2.7 <removed>
@@ -164692,7 +164688,6 @@ CVE-2026-6019 (http.cookies.Morsel.js_output() returns an inline <script> snippe
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u2
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue, unused function)
- pypy3 <unfixed> (bug #1135116)
@@ -171408,7 +171403,6 @@ CVE-2026-1502 (CR/LF bytes were not rejected by HTTP client proxy tunnel headers
- python3.13 3.13.14-1
[trixie] - python3.13 3.13.5-2+deb13u3
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue, response splitting)
- python2.7 <removed>
@@ -191863,7 +191857,6 @@ CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malfor
- python3.14 <not-affected> (Fixed before initial upload to Debian unstable)
- python3.13 3.13.4-1
- python3.11 <removed>
- [bookworm] - python3.11 <no-dsa> (Minor issue)
- python3.9 <removed>
[bullseye] - python3.9 <postponed> (Minor issue, DoS)
- pypy3 8.0.0+dfsg-1 (bug #1141532)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Oct 2026] DLA-4827-1 python3.11 - security update
+ {CVE-2025-69534 CVE-2026-1502 CVE-2026-3276 CVE-2026-6019 CVE-2026-8328 CVE-2026-9669 CVE-2026-15308 CVE-2026-15310 CVE-2026-15806 CVE-2026-17084 CVE-2026-18503 CVE-2026-19445 CVE-2026-19553}
+ [bookworm] - python3.11 3.11.2-6+deb12u9
[07 Oct 2026] DLA-4826-1 puma - security update
{CVE-2026-47736 CVE-2026-47737}
[bookworm] - puma 5.6.5-3+deb12u2
=====================================
data/dla-needed.txt
=====================================
@@ -685,10 +685,6 @@ python-tornado
python-zeroconf
NOTE: 20260804: Added by Front-Desk (rouca)
--
-python3.11 (andrewsh)
- NOTE: 20260916: Added by Front-Desk (Beuc)
- NOTE: 20260916: Follow Debian 13.5 (2 CVEs), 13.6 (6 CVEs) and 13.6 (5 CVEs) (Beuc/front-desk)
---
qemu
NOTE: 20260520: Added by Front-Desk (Beuc)
NOTE: 20260520: Many postponed CVEs piled up (Beuc/front-desk)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1cfd7b5981f2d4f853cdf76cd06c375a5497a8bb
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1cfd7b5981f2d4f853cdf76cd06c375a5497a8bb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/19d46f6f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list