[Git][security-tracker-team/security-tracker][master] Track fixed version for some mistune issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 22 21:45:12 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
26b86790 by Salvatore Bonaccorso at 2026-10-22T21:03:38+02:00
Track fixed version for some mistune issues
Two appears to remain still unfixed according to the upstream
advisories.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -82409,7 +82409,7 @@ CVE-2026-76816 (Netty is an asynchronous, event-driven network application frame
NOTE: Fixed by: https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 (netty-4.2.17.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961 (netty-4.1.137.Final)
CVE-2026-76098 (Mistune is a Python Markdown parser with renderers and plugins. Versio ...)
- - mistune <unfixed> (bug #1145881)
+ - mistune 3.3.4-1 (bug #1145881)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq
@@ -134652,49 +134652,49 @@ CVE-2026-59937 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3887
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae (6.14.0)
CVE-2026-59930 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
[bullseye] - mistune <not-affected> (Directive system introduced after 0.8.4)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9
NOTE: Fixed by: https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b (v3.3.0)
CVE-2026-59929 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
[bullseye] - mistune <postponed> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2
NOTE: Fixed by: https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc (v3.3.0)
CVE-2026-59928 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
[bullseye] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q
NOTE: Fixed by: https://github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69 (v3.3.0)
CVE-2026-59927 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
[bullseye] - mistune <not-affected> (Directive system introduced after 0.8.4)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8
NOTE: Fixed by: https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 (v3.3.0)
CVE-2026-59926 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.1.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <not-affected> (Admonition :class: option introduced in 3.x)
[bullseye] - mistune <not-affected> (Admonition :class: option introduced in 3.x)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-g97x-gvcm-x72h
NOTE: Fixed by: https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2 (v3.2.1)
CVE-2026-59925 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
[bullseye] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
NOTE: Fixed by: https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f (v3.3.0)
CVE-2026-59924 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
[bullseye] - mistune <not-affected> (Directive system introduced after 0.8.4)
@@ -134702,14 +134702,14 @@ CVE-2026-59924 (Mistune is a Python Markdown parser with renderers and plugins.
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf
NOTE: Fixed by: https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993 (v3.3.0)
CVE-2026-59923 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <postponed> (Minor issue)
[bullseye] - mistune <postponed> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3
NOTE: Fixed by: https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc (v3.3.0)
CVE-2026-59922 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
[bullseye] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
@@ -146173,7 +146173,7 @@ CVE-2026-49980 (Rclone is a command-line program to sync files and directories t
[bullseye] - rclone <postponed> (Limited support, minor issue; requires an rclone rcd --rc-serve listener reachable by the attacker without rc HTTP auth)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv
CVE-2026-49851 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1141770)
+ - mistune 3.3.4-1 (bug #1141770)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
[bullseye] - mistune <not-affected> (Vulnerable parser construct introduced in 3.x rewrite)
@@ -169392,19 +169392,19 @@ CVE-2026-44903 (Prometheus is an open-source monitoring system and time series d
CVE-2026-44900 (epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telemat ...)
NOT-FOR-US: epa4all-client
CVE-2026-44899 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1138260)
+ - mistune 3.3.4-1 (bug #1138260)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <no-dsa> (Minor issue)
[bullseye] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9
CVE-2026-44898 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1138260)
+ - mistune 3.3.4-1 (bug #1138260)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <no-dsa> (Minor issue)
[bullseye] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv
CVE-2026-44897 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- - mistune <unfixed> (bug #1138260)
+ - mistune 3.3.4-1 (bug #1138260)
[trixie] - mistune <no-dsa> (Minor issue)
[bookworm] - mistune <no-dsa> (Minor issue)
[bullseye] - mistune <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26b86790f2254bc86cd64ba2dbe89eb54b4760ed
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26b86790f2254bc86cd64ba2dbe89eb54b4760ed
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/961a9f78/attachment.htm>
More information about the debian-security-tracker-commits
mailing list