[Git][security-tracker-team/security-tracker][master] Add two erlang-hex issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2e6343db by Salvatore Bonaccorso at 2026-10-13T07:47:18+02:00
Add two erlang-hex issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,7 +3,12 @@ CVE-2026-9191 (Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x re
 CVE-2026-96618 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
 	NOT-FOR-US: hexpm (server side)
 CVE-2026-96612 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
-	TODO: check
+	- erlang-hex <unfixed>
+	NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3
+	NOTE: https://cna.erlef.org/cves/CVE-2026-96612.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-96612
+	NOTE: Introduced with: https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6 (v0.6.0)
+	NOTE: Fixed by: https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb (v2.5.2)
 CVE-2026-94451 (Quarkus REST Data Panache provides a way to automatically generate RES ...)
 	NOT-FOR-US: Red Hat software not packaged in Debian
 CVE-2026-93695 (In Progress ShareFile Storage Zones Controller v5.12.6 and below, File ...)
@@ -93,7 +98,12 @@ CVE-2026-83536 (A flaw was found in openstack-network-exporter. The HTTP server
 CVE-2026-83535 (A flaw was found in openstack-network-exporter. When an operator confi ...)
 	TODO: check
 CVE-2026-81856 (Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ...)
-	TODO: check
+	- erlang-hex <unfixed>
+	NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-fpmj-3cxg-p766
+	NOTE: https://cna.erlef.org/cves/CVE-2026-81856.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-81856
+	NOTE: Introduced with: https://github.com/hexpm/hex/commit/211303e3f68f5d3ce06450c1ff1a7a770a9ab236 (v0.0.1)
+	NOTE: Fixed by: https://github.com/hexpm/hex/commit/dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8 (v2.5.2)
 CVE-2026-78404 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is vulnerable  ...)
 	NOT-FOR-US: IBM
 CVE-2026-77366 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e6343db0e6fb87dcfae33ebbd13bd40bd0a1e92

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e6343db0e6fb87dcfae33ebbd13bd40bd0a1e92
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261013/02aa66f5/attachment-0001.htm>