[Git][security-tracker-team/security-tracker][master] 2 commits: Track fixed version for cyrus-sasl2 via unstable

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b80cd325 by Salvatore Bonaccorso at 2026-10-17T07:22:18+02:00
Track fixed version for cyrus-sasl2 via unstable

There is still no upstream blessed patch, but Bastian did upload the
suggested fix including in the update a regression test for the issue.
So track the unofficial patch with the fixed version which might be
later replaced once upstram is active.

- - - - -
c794b6bd by Salvatore Bonaccorso at 2026-10-17T07:23:43+02:00
Track proposed update for cyrus-sasl2 via trixie-pu

- - - - -


2 changed files:

- data/CVE/list
- data/next-point-update.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -14423,8 +14423,8 @@ CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to e
 CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
 	NOT-FOR-US: cluster-samples-operator
 CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
-	- cyrus-sasl2 <unfixed> (bug #1150516)
-	[trixie] - cyrus-sasl2 <postponed> (Revisit when fixed upstream)
+	- cyrus-sasl2 2.1.28+dfsg1-12 (bug #1150516)
+	[trixie] - cyrus-sasl2 <no-dsa> (Will be fixed via point release; suggested patch taken for update)
 	NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
 	NOTE: https://github.com/cyrusimap/cyrus-sasl/pull/892
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460420


=====================================
data/next-point-update.txt
=====================================
@@ -408,3 +408,5 @@ CVE-2026-93858
 	[trixie] - mistral 20.0.0-2+deb13u2
 CVE-2026-79655
 	[trixie] - sos 4.9.1-1+deb13u1
+CVE-2026-107161
+	[trixie] - cyrus-sasl2 2.1.28+dfsg1-9+deb13u1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/dfabab696d5c95eb00de7daa1636a642cd562b6c...c794b6bd62090b009c5cdb33ffe23ecf1c53d310

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/dfabab696d5c95eb00de7daa1636a642cd562b6c...c794b6bd62090b009c5cdb33ffe23ecf1c53d310
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/ba91cb5a/attachment.htm>