[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 23 22:53:38 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
76470eac by Salvatore Bonaccorso at 2026-10-23T23:47:37+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1486,41 +1486,41 @@ CVE-2026-114643 (The MongoDB C# Driver writes GeoJSON extra members without chec
CVE-2026-114625 (VeloCloud Orchestrator (VCO) on-prem has a security issue where this i ...)
NOT-FOR-US: Arista Networks
CVE-2026-114620 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8
NOTE: https://github.com/authlib/authlib/pull/949
NOTE: Fixed by: https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0 (v1.9.0)
NOTE: Fixed by: https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6 (v1.9.0)
CVE-2026-114619 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-q686-2qmg-hqc7
NOTE: https://github.com/authlib/authlib/pull/945
NOTE: Fixed by: https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf (v1.9.0)
CVE-2026-114618 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc
NOTE: https://github.com/authlib/authlib/pull/945
NOTE: Fixed by: https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf (v1.9.0)
CVE-2026-114617 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc
NOTE: https://github.com/authlib/authlib/pull/949
NOTE: Fixed by: https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0 (v1.9.0)
CVE-2026-114616 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg
NOTE: Fixed by: https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b (v1.9.1)
CVE-2026-114615 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p
NOTE: https://github.com/authlib/authlib/pull/945
NOTE: Fixed by: https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf (v1.9.0)
CVE-2026-114614 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x
NOTE: Fixed by: https://github.com/authlib/authlib/commit/95ad1f90acf0c7b9cf2a8f25e6eb3f1135b8dc70 (v1.8.0)
CVE-2026-114613 (MessagePack is the serializer implementation for Python msgpack.org. P ...)
- - python-msgpack <unfixed>
+ - python-msgpack <unfixed> (bug #1151844)
NOTE: https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2
NOTE: Fixed by: https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141 (v1.2.3)
CVE-2026-114612 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or ...)
@@ -1548,7 +1548,7 @@ CVE-2026-114607 (Better Auth is an authentication and authorization library for
CVE-2026-114606 (draw.io Desktop is the official Electron build of draw.io. Prior to 31 ...)
NOT-FOR-US: draw.io
CVE-2026-114605 (dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_w ...)
- - dnspython <unfixed>
+ - dnspython <unfixed> (bug #1151842)
NOTE: https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
NOTE: Fixed by: https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023 (v2.9.0)
CVE-2026-114603 (OpenTelemetry Python provides the Python API and SDK for OpenTelemetry ...)
@@ -7171,8 +7171,8 @@ CVE-2026-94018 (The Web add-on's HTTP server dereferences and releases an uninit
CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of any size, ...)
NOT-FOR-US: Eclipse
CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/e49e0c47ea925ad9442ba933a144ea62433d6a06 (11.0.27)
@@ -7193,7 +7193,7 @@ CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (
CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource ...)
NOT-FOR-US: Eclipse
CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parq ...)
- - apache-arrow <unfixed>
+ - apache-arrow <unfixed> (bug #1151849)
NOTE: https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57
NOTE: https://github.com/apache/arrow/issues/51349
NOTE: https://github.com/apache/arrow/pull/51350 (apache-arrow-26.0.0-rc0)
@@ -7216,8 +7216,8 @@ CVE-2026-90798 (A missing circuit-breaker in the replicator in Apache CouchDB 3.
CVE-2026-90797 (An unlimited gzip decompression routine in chttpd in Apache CouchDB 3. ...)
- couchdb <removed>
CVE-2026-88041 (Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer i ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/a276dea827437090498678e09df0539ec397a7b5 (11.0.27)
@@ -7238,16 +7238,16 @@ CVE-2026-75751
CVE-2026-75747
REJECTED
CVE-2026-74049 (Execution After Redirect (EAR) vulnerability in Apache Tomcat. This ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/d7948a090ad3f803d9669c8b8401c39e2f532bb7 (11.0.27)
NOTE: https://github.com/apache/tomcat/commit/f8023d833675f00968b89b45639210d3c7dcc95d (10.1.61)
NOTE: https://github.com/apache/tomcat/commit/6cd2ec7f60b13f8bd93290993401958502c33211 (9.0.123)
CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/db6d674b40ac572f3b2205a4c4f06836516fd3f5 (11.0.27)
@@ -7766,19 +7766,19 @@ CVE-2026-105312 (A Kubernetes tenant with create permission on Console custom re
CVE-2026-105311 (The StreamsHub Console operator acts as a confused deputy: a Kubernete ...)
NOT-FOR-US: Red Hat
CVE-2026-103119 (Buffer under-read vulnerability in Apache Tomcat meant that a large no ...)
- - tomcat11 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
NOTE: https://github.com/apache/tomcat/commit/f13748baa17a5e28925be455e0e2832e2032f58c (11.0.27)
CVE-2026-101356 (Incorrect object recycling and re-use vulnerability in Apache Tomcat a ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/1dc6aa151b3b99b32ac9ae7c60e41c326063321b (11.0.27)
NOTE: https://github.com/apache/tomcat/commit/6c7da60893bd186d6cb2df7330299d7e70e68279 (10.1.61)
NOTE: https://github.com/apache/tomcat/commit/4b1eb9a1664b10471f5740279d9f2e2259c5d108 (9.0.123)
CVE-2026-101296 (A missing critical step in authentication vulnerability in Apache Tomc ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1151848)
+ - tomcat10 <unfixed> (bug #1151847)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
NOTE: https://github.com/apache/tomcat/commit/e43453fc04abb44f64faf571ca98af71aa3c20a1 (11.0.27)
@@ -13495,7 +13495,7 @@ CVE-2026-78850 (An issue in Matomo v.5.11.2 allows a remote attacker to obtain s
- matomo <unfixed>
CVE-2026-77711 (When Jetty's `HttpClient` make a request to a server through a forward ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw
CVE-2026-77470 (Lychee is a free, open-source photo-management tool. Prior to 7.7.1, t ...)
NOT-FOR-US: Lychee
@@ -13509,11 +13509,11 @@ CVE-2026-77460 (EspoCRM is an open source customer relationship management appli
NOT-FOR-US: EspoCRM
CVE-2026-76184 (In Eclipse Jetty, HttpClient may receive a redirect of the form: `` ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768
CVE-2026-76182 (In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be config ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m
TODO: check if tracking correct, issue in multiple jetty components
CVE-2026-75559 (The smartphone application "Vehicle Inspection Certificate Viewer" con ...)
@@ -13685,7 +13685,7 @@ CVE-2026-22896 (A cross-site scripting (XSS) vulnerability has been reported to
NOT-FOR-US: QNAP
CVE-2026-19864 (Eclipse Jetty's `SessionAuthentication` retains authentication credent ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-q6wx-j9wr-fj7f
CVE-2026-19863 (An unauthenticated client may access certain protected resources when ...)
NOT-FOR-US: EtheriumAuthenticator
@@ -13693,19 +13693,19 @@ CVE-2026-19377 (Improper certificate validation in the tunnel handshake in Cato
NOT-FOR-US: Cato
CVE-2026-18662 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv
CVE-2026-18661 (In Eclipse Jetty, across various versions of `jetty-annotations`, and ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f
CVE-2026-18660 (In Eclipse Jetty, across various versions of `jetty-server`, and `jett ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf
CVE-2026-18659 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr
CVE-2026-17525 (Incomplete cleanup vulnerability in ABB My Control System. This issue ...)
NOT-FOR-US: ABB group
@@ -33437,7 +33437,7 @@ CVE-2026-104058 (Podgrab contains a missing authentication vulnerability in whic
CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service vulnerability ca ...)
NOT-FOR-US: Podgrab
CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where discove ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1151845)
NOTE: https://uziii2208.github.io/post/cve-2026-104056/
CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
NOT-FOR-US: WindRiver
@@ -70247,7 +70247,7 @@ CVE-2026-19614 (The API is prone to XML external entity (XXE) injection. By defa
NOTE: https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614
CVE-2026-19203 (A client may issue specially crafted HTTP/1.1 chunked requests to a Je ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h
CVE-2026-18851 (Missing authorization in Ivanti Endpoint Manager Mobile before version ...)
NOT-FOR-US: Ivanti
@@ -70283,7 +70283,7 @@ CVE-2026-12645 (A Missing Authorization vulnerability in Ivanti Neurons for ITSM
NOT-FOR-US: Ivanti
CVE-2026-12611 (A client may issue HTTP/2 requests to a Jetty server that result in bl ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
CVE-2026-12387 (Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm ...)
NOT-FOR-US: Arm
@@ -112055,7 +112055,7 @@ CVE-2026-10709 (A maliciously crafted FBX file, when parsed through Autodesk FBX
NOT-FOR-US: Autodesk
CVE-2026-10050 (In Eclipse Jetty, the Digest authentication server-side component uses ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr
CVE-2026-10032 (The openUrl function in @a2ui/web_core passes an agent-controlled URL ...)
NOT-FOR-US: a2ui/web_core passes
@@ -132113,7 +132113,7 @@ CVE-2026-8590 (Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server mo
NOT-FOR-US: Spotfire
CVE-2026-8384 (In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/sec ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr
NOTE: https://github.com/jetty/jetty.project/pull/14969
NOTE: Fixed by: https://github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084 (jetty-12.0.35)
@@ -132131,7 +132131,7 @@ CVE-2026-6851 (An Improper link resolution before file access ('link following')
NOT-FOR-US: Bitdefender
CVE-2026-6790 (In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-7p3p-8qv8-m2vh
CVE-2026-62659 (A security flaw was discovered in the NETGEAR WAX333 Access Point that ...)
NOT-FOR-US: Netgear
@@ -134131,7 +134131,7 @@ CVE-2026-10573 (A denial-of-service security issue exists in 1734POINTI/O\u2122m
NOT-FOR-US: Rockwell Automation
CVE-2026-10051 (In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the se ...)
- jetty12 12.0.39-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
TODO: check, jetty9 might not be affected as not explicitly mentioned in the GhSA and still supported
CVE-2026-0515 (Insufficient Parameter Validation in the SchedGet() system call could ...)
@@ -197463,7 +197463,7 @@ CVE-2026-2399 (CWE-22 Improper Limitation of a Pathname to a Restricted Director
NOT-FOR-US: Schneider Electric
CVE-2026-2332 (In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggli ...)
- jetty12 12.0.33-1
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf
CVE-2026-27931 (Out-of-bounds read in Windows GDI allows an unauthorized attacker to d ...)
NOT-FOR-US: Microsoft
@@ -219609,7 +219609,7 @@ CVE-2025-13350 (Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector
CVE-2025-11143 (The Jetty URI parser has some key differences to other common parsers ...)
- jetty12 12.0.32-1
[trixie] - jetty12 <no-dsa> (Minor issue)
- - jetty9 <unfixed>
+ - jetty9 <unfixed> (bug #1151846)
[trixie] - jetty9 <no-dsa> (Minor issue)
[bookworm] - jetty9 <no-dsa> (Minor issue)
[bullseye] - jetty9 <postponed> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/76470eac25dcfb25750434e80e9198aece382fa3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/76470eac25dcfb25750434e80e9198aece382fa3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/c2f65269/attachment.htm>
More information about the debian-security-tracker-commits
mailing list