[Git][security-tracker-team/security-tracker][master] Reserve DLA-4844-1 for libssh

[Simon Quigley (@tsimonq2)]

Simon Quigley pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c9be02e0 by Simon Quigley at 2026-10-20T14:42:34-05:00
Reserve DLA-4844-1 for libssh

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -210775,7 +210775,6 @@ CVE-2026-3732 (A security vulnerability has been detected in Tenda F453 1.0.0.3.
 CVE-2026-3731 (A weakness has been identified in libssh up to 0.11.3. The impacted el ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=f80670a7aba86cbb442c9b115c9eaf4ca04601b8 (libssh-0.11.4)
@@ -221995,7 +221994,6 @@ CVE-2018-25157 (Phraseanet 4.0.3 contains a stored cross-site scripting vulnerab
 CVE-2026-0968 (A flaw was found in libssh in which a malicious SFTP (SSH File Transfe ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-0968.txt
 	NOTE: Tests: https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 (libssh-0.11.4)
@@ -222003,14 +222001,12 @@ CVE-2026-0968 (A flaw was found in libssh in which a malicious SFTP (SSH File Tr
 CVE-2026-0967 (A flaw was found in libssh. A remote attacker, by controlling client c ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-0967.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=6d74aa6138895b3662bade9bd578338b0c4f8a15 (libssh-0.11.4)
 CVE-2026-0966 (A flaw was found in libssh. The API function `ssh_get_hexa()` is vulne ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-0966.txt
 	NOTE: Documentation: https://git.libssh.org/projects/libssh.git/commit/?id=3e1d276a5a030938a8f144f46ff4f2a2efe31ced (libssh-0.11.4)
@@ -222019,14 +222015,12 @@ CVE-2026-0966 (A flaw was found in libssh. The API function `ssh_get_hexa()` is
 CVE-2026-0965 (A flaw was found in libssh where it can attempt to open arbitrary file ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-0965.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=bf390a042623e02abc8f421c4c5fadc0429a8a76 (libssh-0.11.4)
 CVE-2026-0964 (A malicious SCP server can send unexpected paths that could make the c ...)
 	{DSA-6410-1}
 	- libssh 0.12.0-1 (bug #1127693)
-	[bookworm] - libssh <no-dsa> (Minor issue)
 	[bullseye] - libssh <postponed> (Minor issue)
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-0964.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=a5e4b12090b0c939d85af4f29280e40c5b6600aa (libssh-0.11.4)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[20 Oct 2026] DLA-4844-1 libssh - security update
+	{CVE-2026-0964 CVE-2026-0965 CVE-2026-0966 CVE-2026-0967 CVE-2026-0968 CVE-2026-3731 CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59850}
+	[bookworm] - libssh 0.10.6-0+deb12u3
 [19 Oct 2026] DLA-4843-1 python-django - security update
 	{CVE-2026-77050 CVE-2026-87975}
 	[bookworm] - python-django 3:3.2.25-0+deb12u6


=====================================
data/dla-needed.txt
=====================================
@@ -405,10 +405,6 @@ libsoup2.4
   NOTE: 20260727: not-affected (no HTTP/2 in libsoup 2.x). Only
   NOTE: 20260727: CVE-2026-12548 has an upstream fix (3.7.1). (utkarsh)
 --
-libssh (Simon Quigley)
-  NOTE: 20260731: Added by Front-Desk (ta)
-  NOTE: 20261016: https://lists.debian.org/debian-lts/2026/10/msg00071.html (tsimonq2)
---
 libvirt (Abhijith PA)
   NOTE: 20260919: Added by Front-Desk (Beuc)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9be02e08b98b37c89c057f2dcb954d71064178f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9be02e08b98b37c89c057f2dcb954d71064178f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/dced3437/attachment.htm>