[Git][security-tracker-team/security-tracker][master] Add more python-aiohttp issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
19cdb6ae by Salvatore Bonaccorso at 2026-10-20T09:52:37+02:00
Add more python-aiohttp issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1098,13 +1098,21 @@ CVE-2026-111406 (Unrestricted Upload of File with Dangerous Type vulnerability i
 CVE-2026-111398 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111066 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
-	TODO: check
+	- python-aiohttp <unfixed>
+	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg
+	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09 (v3.14.4)
 CVE-2026-111065 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
-	TODO: check
+	- python-aiohttp <unfixed>
+	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm
+	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805 (v3.14.4)
 CVE-2026-111064 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
-	TODO: check
+	- python-aiohttp <unfixed>
+	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3
+	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3 (v3.14.4)
 CVE-2026-111063 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
-	TODO: check
+	- python-aiohttp <unfixed>
+	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3
+	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5 (v3.14.4)
 CVE-2026-111061 (russh is a Rust SSH client and server library that includes an SSH age ...)
 	TODO: check
 CVE-2026-111059 (Mercury is a Python framework for sharing Jupyter notebooks as web app ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19cdb6ae8e7f12217812d4fbed1de5081850ff78

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19cdb6ae8e7f12217812d4fbed1de5081850ff78
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/5eba5669/attachment.htm>