[Git][security-tracker-team/security-tracker][master] new cyrus-sasl issue

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a314cdc4 by Moritz Muehlenhoff at 2026-10-08T12:57:56+02:00
new cyrus-sasl issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -311,7 +311,10 @@ CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to e
 CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
 	NOT-FOR-US: cluster-samples-operator
 CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
-	TODO: check
+	- cyrus-sasl2 <unfixed>
+	NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
+	NOTE: https://github.com/cyrusimap/cyrus-sasl/pull/892
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460420
 CVE-2026-105820 (Vault's ACL policy cache allowed namespace traversal when policy names ...)
 	NOT-FOR-US: Hashicorp products not packaged in Debian
 CVE-2026-105818 (Vault's PKI secrets engine ACME server did not restrict certificate id ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a314cdc4c5db772dc5f55402323dce17e4709faf

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a314cdc4c5db772dc5f55402323dce17e4709faf
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/6cf0f53c/attachment.htm>