[Git][security-tracker-team/security-tracker][master] Reserve DSA number for curl update

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e1479ab6 by Salvatore Bonaccorso at 2026-10-14T08:06:26+02:00
Reserve DSA number for curl update

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -129878,7 +129878,6 @@ CVE-2025-64105 (FOSSBilling is a billing and client management system that autom
 	NOT-FOR-US: FOSSBilling
 CVE-2026-8286 (A vulnerability exists where a new transfer that uses STARTTLS to upgr ...)
 	- curl 8.21.0~rc2-1
-	[trixie] - curl <no-dsa> (Minor issue)
 	[bookworm] - curl <postponed> (Minor issue; STARTTLS connection reuse config mismatch)
 	[bullseye] - curl <postponed> (Minor issue; STARTTLS connection reuse config mismatch)
 	NOTE: https://curl.se/docs/CVE-2026-8286.html
@@ -129894,7 +129893,6 @@ CVE-2026-8458 (libcurl might in some circumstances reuse the wrong connection wh
 	NOTE: Fixed by: https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d (rc-8_21_0-1, curl-8_21_0)
 CVE-2026-8924 (A flaw in curl\u2019s cookie parsing logic allows a malicious HTTP ser ...)
 	- curl 8.21.0~rc2-1
-	[trixie] - curl <no-dsa> (Minor issue)
 	[bookworm] - curl <postponed> (Minor issue; trailing-dot super cookie; PSL-enabled build mitigates)
 	[bullseye] - curl <postponed> (Minor issue; trailing-dot super cookie; PSL-enabled build mitigates)
 	NOTE: https://curl.se/docs/CVE-2026-8924.html
@@ -129918,7 +129916,6 @@ CVE-2026-8926 (When asking curl to use a `.netrc` file to find credentials and a
 	NOTE: Fixed by: https://github.com/curl/curl/commit/4ae1d7cc2643e4773a136395f12bc02fc6867854 (rc-8_21_0-1, curl-8_21_0)
 CVE-2026-8927 (When reusing a libcurl handle for sequential transfers driven by envir ...)
 	- curl 8.21.0~rc2-1
-	[trixie] - curl <no-dsa> (Minor issue)
 	[bookworm] - curl <postponed> (Minor issue; libcurl env-proxy Digest auth handle reuse)
 	[bullseye] - curl <postponed> (Minor issue; libcurl env-proxy Digest auth handle reuse)
 	NOTE: https://curl.se/docs/CVE-2026-8927.html


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,6 @@
+[14 Oct 2026] DSA-6558-1 curl - security update
+	{CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-92392}
+	[trixie] - curl 8.14.1-2+deb13u7
 [12 Oct 2026] DSA-6557-1 ntfs-3g - security update
 	[trixie] - ntfs-3g 1:2022.10.3-5+deb13u3
 [12 Oct 2026] DSA-6556-1 nagios4 - security update


=====================================
data/dsa-needed.txt
=====================================
@@ -38,9 +38,6 @@ cups
 --
 dulwich
 --
-curl (carnil)
-  Maintainer prepared an update for higher severity issue, rest will be via point release
---
 emacs (jmm)
 --
 ejabberd



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1479ab613524d21329128ad7a0dbb0ee351de58

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1479ab613524d21329128ad7a0dbb0ee351de58
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/fc82adc0/attachment-0001.htm>