[Git][security-tracker-team/security-tracker][master] rails: mark CVE-2026-33658 and CVE-2026-33174 as not-affected for Bookworm

[Simon Quigley (@tsimonq2)]

Simon Quigley pushed to branch master at Debian Security Tracker / security-tracker


Commits:
691d8f77 by Simon Quigley at 2026-10-08T07:48:17-05:00
rails: mark CVE-2026-33658 and CVE-2026-33174 as not-affected for Bookworm

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -179835,7 +179835,7 @@ CVE-2026-33661 (Pay is an open-source payment SDK extension package for various
 CVE-2026-33658 (Active Storage allows users to attach cloud and local files in Rails a ...)
 	{DSA-6546-1}
 	- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
-	[bookworm] - rails <no-dsa> (Minor issue)
+	[bookworm] - rails <not-affected> (Vulnerable code introduced later; ActiveStorage::Streaming proxy Range handling added in 7.0)
 	[bullseye] - rails <postponed> (Minor issue, DoS)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
 	NOTE: Fixed by: https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06 (v8.1.2.1)
@@ -183493,7 +183493,7 @@ CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core e
 CVE-2026-33174 (Active Storage allows users to attach cloud and local files in Rails a ...)
 	{DSA-6546-1}
 	- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
-	[bookworm] - rails <no-dsa> (Minor issue)
+	[bookworm] - rails <not-affected> (Vulnerable code introduced later; ActiveStorage::Streaming proxy Range handling added in 7.0)
 	[bullseye] - rails <postponed> (Minor issue, DoS)
 	NOTE: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
 	NOTE: Fixed by: https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a (v8.1.2.1)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/691d8f77ebd65d17ae02902709887dc4a08974bd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/691d8f77ebd65d17ae02902709887dc4a08974bd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/5619a568/attachment.htm>