[Git][security-tracker-team/security-tracker][master] Reserve DLA-4846-1 for git-lfs

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ff5f0d06 by Sylvain Beucler at 2026-10-21T09:43:31+02:00
Reserve DLA-4846-1 for git-lfs

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -269708,7 +269708,6 @@ CVE-2025-26625 (Git LFS is a Git extension for versioning large files. In Git LF
 	{DLA-4610-1}
 	- git-lfs 3.7.1-1 (bug #1118339)
 	[trixie] - git-lfs 3.6.1-1+deb13u1
-	[bookworm] - git-lfs <no-dsa> (Minor issue)
 	NOTE: https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5
 	NOTE: Fixed by: https://github.com/git-lfs/git-lfs/commit/35728a6d0d488a5904cc9f03ac302680d0858583 (v3.8.0)
 	NOTE: Fixed by: https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8 (v3.8.0)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[21 Oct 2026] DLA-4846-1 git-lfs - security update
+	{CVE-2025-26625}
+	[bookworm] - git-lfs 3.3.0-1+deb12u2
 [20 Oct 2026] DLA-4845-1 ca-certificates - security update
 	[bookworm] - ca-certificates 20250419~deb12u2
 [20 Oct 2026] DLA-4844-1 libssh - security update


=====================================
data/dla-needed.txt
=====================================
@@ -256,11 +256,6 @@ gimp
   NOTE: 20260709: PSP/PNM/PSD parser overflows CVE-2026-58379..58388 (crafted image); TIM-loader
   NOTE: 20260709: CVE-2026-59089 not-affected (GIMP 3.x-only).
 --
-git-lfs (Sylvain Beucler)
-  NOTE: 20260718: Added by Front-Desk (Beuc)
-  NOTE: 20260718: 1 CVE fixed in both bullseye and trixie (Beuc/front-desk)
-  NOTE: 20260914: Ivo Marino mentioned in debian-lts that has patches ready (santiago)
---
 glibc
   NOTE: 20260919: Added by Front-Desk (Beuc)
   NOTE: 20260918: At minimum, follow Debian 13.7 (2 CVEs) (Beuc/front-desk)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff5f0d06ec1918fba99c00c4f1964c40daa791ac

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff5f0d06ec1918fba99c00c4f1964c40daa791ac
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261021/e2b98c1d/attachment-0001.htm>