[Git][security-tracker-team/security-tracker][master] Add references for TLS libraries issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
815f1dd1 by Salvatore Bonaccorso at 2026-10-15T08:27:35+02:00
Add references for TLS libraries issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -34255,6 +34255,7 @@ CVE-2026-93601 (rustls-webpki (the Rust webpki fork used by rustls) versions >=
 	- rust-rustls-webpki 0.103.13+ds-1
 	[trixie] - rust-rustls-webpki <no-dsa> (Minor issue)
 	NOTE: https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/11
 CVE-2026-93600 (rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0. ...)
 	- rust-rustls-webpki 0.103.13+ds-1
 	[trixie] - rust-rustls-webpki <no-dsa> (Minor issue)
@@ -173968,6 +173969,7 @@ CVE-2026-3833 (A flaw was found in gnutls. This vulnerability occurs because gnu
 	NOTE: https://gitlab.com/gnutls/gnutls/-/issues/1803
 	NOTE: https://gitlab.com/gnutls/gnutls/-/issues/1852
 	NOTE: Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5 (3.8.13)
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/11
 CVE-2026-42010 (A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest\u2 ...)
 	{DSA-6281-1 DLA-4595-1}
 	- gnutls28 3.8.13-1 (bug #1135319)
@@ -184149,6 +184151,7 @@ CVE-2026-5263 (URI nameConstraints from constrained intermediate CAs are parsed
 	[bullseye] - wolfssl <postponed> (Minor issue)
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10048
 	NOTE: Fixed by: https://github.com/wolfSSL/wolfssl/commit/ce74def87775dbcf5e221f0361b43d0746ea5710 (v5.9.1-stable)
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/11
 CVE-2026-5194 (Missing hash/digest size and OID checks allow digests smaller than all ...)
 	{DLA-4683-1}
 	- wolfssl 5.9.1-0.1 (bug #1133835)
@@ -186136,6 +186139,7 @@ CVE-2026-33810 (When verifying a certificate chain containing excluded DNS const
 	NOTE: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
 	NOTE: https://github.com/golang/go/issues/78332
 	NOTE: Fixed by: https://github.com/golang/go/commit/ceb4da6626ce94d75b2aefd0f24c6d0fd74f45f9 (go1.26.2)
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/11
 CVE-2026-33439 (Open Access Management (OpenAM) is an access management solution. Prio ...)
 	NOT-FOR-US: Open Access Management (OpenAM)
 CVE-2026-33273 (Unrestricted upload of file with dangerous type issue exists in MATCHA ...)
@@ -190818,6 +190822,7 @@ CVE-2026-34073 (cryptography is a package designed to expose cryptographic primi
 	[bookworm] - python-cryptography <no-dsa> (Minor issue)
 	[bullseye] - python-cryptography <postponed> (Minor issue)
 	NOTE: https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/14/11
 CVE-2026-34070 (LangChain is a framework for building agents and LLM-powered applicati ...)
 	NOT-FOR-US: LangChain
 CVE-2026-34060 (Ruby LSP is an implementation of the language server protocol for Ruby ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/815f1dd1c06572a5fe55ca5042f97c9ba3b196a5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/815f1dd1c06572a5fe55ca5042f97c9ba3b196a5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/ab641312/attachment-0001.htm>