[Git][security-tracker-team/security-tracker][master] Add new Dulwich issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9720021c by Salvatore Bonaccorso at 2026-10-22T22:22:07+02:00
Add new Dulwich issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2845,15 +2845,20 @@ CVE-2026-114100 (Coraza from 3.0.4 before 3.8.1 contains a request body inspecti
 CVE-2026-114099 (Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens ...)
 	NOT-FOR-US: Coraza WAF
 CVE-2026-114098 (Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerabili ...)
-	TODO: check
+	- dulwich 1.2.8-1
+	NOTE: https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx
 CVE-2026-114097 (Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerabili ...)
-	TODO: check
+	- dulwich 1.2.8-1
+	NOTE: https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798
 CVE-2026-114096 (Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerab ...)
-	TODO: check
+	- dulwich 1.2.8-1
+	NOTE: https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33
 CVE-2026-114095 (Dulwich before 1.2.9 contains a denial of service vulnerability in Pac ...)
-	TODO: check
+	- dulwich 1.2.11-1
+	NOTE: https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg
 CVE-2026-114094 (Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Gi ...)
-	TODO: check
+	- dulwich <not-affected> (Windows-specific)
+	NOTE: https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf
 CVE-2026-114093 (Trigger.dev before 4.5.6 contains a cross-site request forgery vulnera ...)
 	NOT-FOR-US: Trigger.dev
 CVE-2026-114092 (Trigger.dev before 4.5.0 performs no authentication or organization ch ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9720021c4ab5d1cb15bcc196d8075a9719daeeb3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9720021c4ab5d1cb15bcc196d8075a9719daeeb3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/f1f03799/attachment.htm>