[Git][security-tracker-team/security-tracker][master] trixie triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e7e81908 by Moritz Muehlenhoff at 2026-10-15T21:32:46+02:00
trixie triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -6980,6 +6980,7 @@ CVE-2026-109153 (A vulnerability was detected in MosaicML Composer up to 0.32.1.
 	NOT-FOR-US: MosaicML Composer
 CVE-2026-109152 (A security vulnerability has been detected in jbardin scp.py up to 0.1 ...)
 	- python-scp 0.16.2-1
+	[trixie] - python-scp <no-dsa> (Minor issue)
 	NOTE: https://github.com/jbardin/scp.py/issues/206
 	NOTE: https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d (v0.16.2)
 CVE-2026-109149 (A weakness has been identified in beautifier js-beautify up to 1.15.1/ ...)
@@ -8642,7 +8643,7 @@ CVE-2026-109448 (Integer wraparound in psqlODBC SQLBindParameter allows an appli
 	NOTE: https://github.com/postgresql-interfaces/psqlodbc/commit/86e4418e9553aa0891315db7531f8cd31eb1575e (REL-18_00_0005)
 CVE-2026-109399 (SWUpdate through 2026.05.1 contains an improper certificate validation ...)
 	- swupdate 2026.05+dfsg-1
-	[trixie] - swupdate <not-affected> (swupdate in Trixie builds with WolfSSL)
+	[trixie] - swupdate <not-affected> (swupdate in Trixie builds with WolfSSL calls wolfSSL_X509_STORE_CTX_init with untrusted intermediates set to NULL)
 	NOTE: https://groups.google.com/g/swupdate/c/dsoMcGFnEns
 	NOTE: https://github.com/sbabic/swupdate/commit/e66c5640664a31668926a24c0c84b6b6570dc0d9 (2026.05)
 CVE-2026-109398 (Gumlet php-image-resize before 3.0.1 contains a denial of service vuln ...)
@@ -16933,10 +16934,12 @@ CVE-2026-104039 (A flaw was found in SSSD. A local user can cause a denial of se
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478956
 CVE-2026-104038 (A flaw was found in sssd. A remote attacker can cause a denial of serv ...)
 	- sssd <unfixed> (bug #1150238)
+	[trixie] - sssd <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478980
 CVE-2026-104037 (A flaw was found in SSSD. A local attacker can exploit this issue by s ...)
-	- sssd <unfixed> (bug #1150238)
+	- sssd <unfixed> (bug #1150238; unimportant)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479030
+	NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
 CVE-2026-104036 (A flaw was found in SSSD's NFS idmap plugin. When retrieving cached us ...)
 	- sssd <unfixed> (bug #1150238)
 	[trixie] - sssd <no-dsa> (Minor issue)
@@ -16946,8 +16949,9 @@ CVE-2026-104035 (A flaw was found in SSSD. An issue in the Kerberos Credential M
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479107
 	NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
 CVE-2026-104034 (A flaw was found in SSSD. A use-after-free vulnerability exists in the ...)
-	- sssd <unfixed> (bug #1150238)
+	- sssd <unfixed> (bug #1150238; unimportant)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479178
+	NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
 CVE-2026-104033 (A flaw was found in SSSD. When configured to enforce account expiratio ...)
 	- sssd <unfixed> (bug #1150238)
 	[trixie] - sssd <no-dsa> (Minor issue)


=====================================
data/dsa-needed.txt
=====================================
@@ -81,6 +81,8 @@ kitty
 --
 libnet-idn-encode-perl (carnil)
 --
+libreswan
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more 6.12.y versions



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e7e81908a2526916cc8b3d3c0694ee8f71174685

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e7e81908a2526916cc8b3d3c0694ee8f71174685
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/b09746f7/attachment.htm>