[Git][security-tracker-team/security-tracker][master] Add new ruby-mechanize issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6ec23a43 by Salvatore Bonaccorso at 2026-10-09T11:01:54+02:00
Add new ruby-mechanize issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -469,9 +469,18 @@ CVE-2026-107717 (Banks generates meaningful LLM prompts using a simple template
 CVE-2026-107716 (Banks generates meaningful LLM prompts using a simple template languag ...)
 	NOT-FOR-US: Banks
 CVE-2026-107715 (The Mechanize library is used for automating interaction with websites ...)
-	TODO: check
+	- ruby-mechanize 2.14.1-1
+	NOTE: https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7
+	NOTE: https://github.com/sparklemotion/mechanize/pull/676
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f (v2.14.1)
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745 (v2.14.1)
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95 (v2.14.1)
 CVE-2026-107714 (The Mechanize library is used for automating interaction with websites ...)
-	TODO: check
+	- ruby-mechanize 2.14.1-1
+	NOTE: https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99
+	NOTE: https://github.com/sparklemotion/mechanize/pull/676
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f (v2.14.1)
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43ba (v2.14.1)
 CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip through  ...)
 	NOT-FOR-US: Bower decompress-zip
 CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerabil ...)
@@ -594,7 +603,11 @@ CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability allows
 CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code Execution or Deni ...)
 	NOT-FOR-US: NetScaler
 CVE-2026-107399 (The Mechanize library is used for automating interaction with websites ...)
-	TODO: check
+	- ruby-mechanize 2.14.1-1
+	NOTE: https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f
+	NOTE: https://github.com/sparklemotion/mechanize/pull/676
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f (v2.14.1)
+	NOTE: Fixed by: https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3 (v2.14.1)
 CVE-2026-107397 (Indico is an event management system that uses Flask-Multipass, a mult ...)
 	TODO: check
 CVE-2026-107396 (Indico is an event management system that uses Flask-Multipass, a mult ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ec23a43bc7cbdaf3c88d8a35149f18ea955e341

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ec23a43bc7cbdaf3c88d8a35149f18ea955e341
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/a7c62c14/attachment.htm>