[Git][security-tracker-team/security-tracker][master] new python-mcp issue

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cec40b83 by Moritz Muehlenhoff at 2026-10-16T14:37:19+02:00
new python-mcp issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2296,21 +2296,24 @@ CVE-2026-110248 (Insertion of sensitive information into log files in the git_ut
 CVE-2026-110227 (Missing Authorization vulnerability in 10up Restricted Site Access res ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109971 (A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11  ...)
-	- clevis <unfixed>
+	- clevis <unfixed> (bug #1150905)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550363
 CVE-2026-109970 (A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-ask ...)
-	- clevis <unfixed>
+	- clevis <unfixed> (bug #1150905)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550362
 CVE-2026-109969 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
-	- clevis <unfixed>
+	- clevis <unfixed> (bug #1150905)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550361
 CVE-2026-109968 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
-	- clevis <unfixed>
+	- clevis <unfixed> (bug #1150905)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462394
 CVE-2026-109901 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-109527 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
-	TODO: check
+	- python-mcp <unfixed>
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c (v1.29.1)
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189 (v1.29.0)
 CVE-2026-109506 (Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-an ...)
 	NOT-FOR-US: TPLink
 CVE-2026-109439 (Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec40b8357fc8c8605595925e58d7dc685470ff7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cec40b8357fc8c8605595925e58d7dc685470ff7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/570466ce/attachment.htm>