[Git][security-tracker-team/security-tracker][master] auto-nfu: Extend Apache rule

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
299ed0be by Moritz Muehlenhoff at 2026-10-12T23:16:01+02:00
auto-nfu: Extend Apache rule

- - - - -


2 changed files:

- data/CVE/list
- data/packages/nfu.yaml


Changes:

=====================================
data/CVE/list
=====================================
@@ -5,7 +5,7 @@ CVE-2026-96618 (Improper Handling of Highly Compressed Data (Data Amplification)
 CVE-2026-96612 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
 	TODO: check
 CVE-2026-94451 (Quarkus REST Data Panache provides a way to automatically generate RES ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-93695 (In Progress ShareFile Storage Zones Controller v5.12.6 and below, File ...)
 	NOT-FOR-US: Progress Software
 CVE-2026-93694 (In Progress ShareFile Storage Zones Controller v5.12.6 and below, proc ...)
@@ -21,7 +21,7 @@ CVE-2026-92681 (In @neo4j/graphql versions up to and including 7.6.3, @authentic
 CVE-2026-89140 (Temporal Server does not bind internal completion callbacks to the nam ...)
 	NOT-FOR-US: Temporal Technologies
 CVE-2026-87744 (A flaw was found in Quarkus REST Data Panache. This vulnerability allo ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-85976 (Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x release ...)
 	NOT-FOR-US: Progress Software
 CVE-2026-85975 (Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x release ...)
@@ -103,7 +103,7 @@ CVE-2026-77364 (obsidian-tc is a governed, agent-ready Model Context Protocol se
 CVE-2026-77363 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
 	TODO: check
 CVE-2026-75888 (A flaw was found in the OpenShift console. An authenticated console us ...)
-	TODO: check
+	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-6232 (An out-of-bounds write vulnerability in the SPI host command interface ...)
 	TODO: check
 CVE-2026-68764


=====================================
data/packages/nfu.yaml
=====================================
@@ -916,8 +916,11 @@
   allOf:
     - cna: redhat
     - anyOf:
+      - product: Exploit Intelligence
       - product: 'mirror registry for Red Hat OpenShift.*'
-      - product: 'Red Hat Quay.*'
+      - product: '.*Quay.*'
+      - product: '.*Quarkus.*'
+      - product: 'Red Hat OpenShift Container Platform.*'
 - reason: Samsung
   allOf:
     - cna: samsung.tv_appliance



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/299ed0be653eb840d778c6897c1d939551d83500

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/299ed0be653eb840d778c6897c1d939551d83500
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/8b61dd87/attachment-0001.htm>