[Git][security-tracker-team/security-tracker][master] Reserve DLA-4829-1 for rails
Simon Quigley (@tsimonq2)
tsimonq2 at debian.org
Thu Oct 8 17:00:16 BST 2026
Simon Quigley pushed to branch master at Debian Security Tracker / security-tracker
Commits:
535ad99c by Simon Quigley at 2026-10-08T11:00:09-05:00
Reserve DLA-4829-1 for rails
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -183472,7 +183472,6 @@ CVE-2026-33211 (Tekton Pipelines project provides k8s-style resources for declar
CVE-2026-33202 (Active Storage allows users to attach cloud and local files in Rails a ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
NOTE: Fixed by: https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c (v8.1.2.1)
@@ -183481,7 +183480,6 @@ CVE-2026-33202 (Active Storage allows users to attach cloud and local files in R
CVE-2026-33195 (Active Storage allows users to attach cloud and local files in Rails a ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, path traversal in unlikely scenario)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
NOTE: Fixed by: https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655 (v8.1.2.1)
@@ -183490,7 +183488,6 @@ CVE-2026-33195 (Active Storage allows users to attach cloud and local files in R
CVE-2026-33176 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
NOTE: Fixed by: https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb (v8.1.2.1)
@@ -183508,7 +183505,6 @@ CVE-2026-33174 (Active Storage allows users to attach cloud and local files in R
CVE-2026-33173 (Active Storage allows users to attach cloud and local files in Rails a ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, automatic content type bypass)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
NOTE: Fixed by: https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0 (v8.1.2.1)
@@ -183517,7 +183513,6 @@ CVE-2026-33173 (Active Storage allows users to attach cloud and local files in R
CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
NOTE: Fixed by: https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 (v8.1.2.1)
@@ -183526,7 +183521,6 @@ CVE-2026-33170 (Active Support is a toolkit of support libraries and Ruby core e
CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core extensi ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
NOTE: Fixed by: https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49 (v8.1.2.1)
@@ -183535,7 +183529,6 @@ CVE-2026-33169 (Active Support is a toolkit of support libraries and Ruby core e
CVE-2026-33168 (Action View provides conventions and helpers for building web pages wi ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
[bullseye] - rails <postponed> (Minor issue, XSS)
NOTE: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
NOTE: Fixed by: https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d (v8.1.2.1)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Oct 2026] DLA-4829-1 rails - security update
+ {CVE-2026-33168 CVE-2026-33169 CVE-2026-33170 CVE-2026-33173 CVE-2026-33176 CVE-2026-33195 CVE-2026-33202 CVE-2026-66066}
+ [bookworm] - rails 2:6.1.7.10+dfsg-1~deb12u3
[08 Oct 2026] DLA-4828-1 gst-plugins-base1.0 - security update
{CVE-2026-18297 CVE-2026-85150}
[bookworm] - gst-plugins-base1.0 1.22.0-3+deb12u7
=====================================
data/dla-needed.txt
=====================================
@@ -697,10 +697,6 @@ rabbitmq-server (Abhijith PA)
radsecproxy
NOTE: 20260927: Added by Front-Desk (ta)
--
-rails (Simon Quigley)
- NOTE: 20260805: Added by Front-Desk (rouca)
- NOTE: 20261005: https://lists.debian.org/debian-lts/2026/10/msg00032.html (tsimonq2)
---
rsync
NOTE: 20260615: Added by Front-Desk (charles)
NOTE: 20260615: Requested by Sylvain to track regressions, same as in dsa-needed. (charles)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/535ad99c4140587385422cc3843e5e9da00ae65d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/535ad99c4140587385422cc3843e5e9da00ae65d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/cdebeeea/attachment.htm>
More information about the debian-security-tracker-commits
mailing list