[Git][security-tracker-team/security-tracker][master] auto-nfu: Add Red Hat rule

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d09b6b5e by Moritz Muehlenhoff at 2026-10-12T23:09:56+02:00
auto-nfu: Add Red Hat rule

- - - - -


2 changed files:

- data/CVE/list
- data/packages/nfu.yaml


Changes:

=====================================
data/CVE/list
=====================================
@@ -85,7 +85,7 @@ CVE-2026-85947 (Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x r
 CVE-2026-85499 (Improper Authorization vulnerability in Apache SkyWalking BanyanDB.    ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-85471 (A flaw was found in Quay. An authenticated repository administrator co ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-84286 (ExLlamaV3\u2019s EXL3 loader uses an untrusted, model-supplied index t ...)
 	TODO: check
 CVE-2026-83536 (A flaw was found in openstack-network-exporter. The HTTP server within ...)
@@ -479,9 +479,9 @@ CVE-2026-109200 (LogicalDOC Community Edition through 9.3 contains a server-side
 CVE-2026-109199 (LogicalDOC Community Edition through 9.3 contains a code injection vul ...)
 	TODO: check
 CVE-2026-109195 (A flaw was found in Quay. An authenticated attacker can access reposit ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-109194 (A flaw was found in Red Hat Quay. The build trigger management applica ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-109188 (jshERP through 3.6 contains a missing authorization vulnerability that ...)
 	NOT-FOR-US: jshERP
 CVE-2026-109187 (jshERP through 3.6 contains an information disclosure vulnerability th ...)


=====================================
data/packages/nfu.yaml
=====================================
@@ -912,6 +912,12 @@
     - cna: rapid7
     - anyOf:
       - product: Velociraptor
+- reason: Red Hat software not packaged in Debian
+  allOf:
+    - cna: redhat
+    - anyOf:
+      - product: 'mirror registry for Red Hat OpenShift.*'
+      - product: 'Red Hat Quay.*'
 - reason: Samsung
   allOf:
     - cna: samsung.tv_appliance



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d09b6b5e1230da98d19102740954f2dae5a970ad

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d09b6b5e1230da98d19102740954f2dae5a970ad
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/b0a2d15d/attachment.htm>