[Git][security-tracker-team/security-tracker][master] Update status for ruby issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8cb62487 by Salvatore Bonaccorso at 2026-10-24T17:00:14+02:00
Update status for ruby issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3389,7 +3389,12 @@ CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attack
 	NOTE: https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=e1672c9ca04c81b544a60e316eb2bb4af02381e1 (v3.0.30)
 	NOTE: https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=f07a3dbd514ac585177792cca1ff0e5008f28b60 (v2.6.35)
 CVE-2026-110264 (An issue has been discovered in GitLab CE/EE affecting all versions fr ...)
-	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
+	- ruby3.3 <unfixed>
+	- ruby3.1 <removed>
+	NOTE: https://github.com/ruby/ruby/pull/16801
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/493d26dcdea8b2f0ac5d28e057b401bc809e7fae (v4.1.0-preview1)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/63eda2681e24cdf9fbe45fdd8a3d8866f4f59878 (v3_3_13)
+	NOTE: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
 CVE-2026-110011 (The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2 ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-110010 (The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2 ...)
@@ -22107,7 +22112,14 @@ CVE-2026-9268 (GitLab has remediated an issue in GitLab EE affecting all version
 CVE-2026-97691 (Convex is an open-source reactive database for application developers. ...)
 	NOT-FOR-US: Convex
 CVE-2026-97229 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
-	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
+	- ruby3.3 <unfixed>
+	- ruby3.1 <removed>
+	NOTE: https://github.com/ruby/ruby/pull/19020
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/7cfe8dc82f9f1b3f9c37c78e362fcbdf3c0b84f4 (v4.1.0-preview1)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/cf35145fc46bc278e0ab0003478fc4afe6564819 (v4.1.0-preview1)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/fa98ef030a54595d4387998b2fb48a412fc5c63c (v3_3_13)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/b03e500193371ae87dc4536d855008b42a9cd1a7 (v3_3_13)
+	NOTE: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
 CVE-2026-96893 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-96266 (IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by  ...)
@@ -45840,7 +45852,14 @@ CVE-2026-93620 (Unauthenticated Broken Access Control in PayPlus Payment Gateway
 CVE-2026-93618 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93577 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
-	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
+	- ruby3.3 <unfixed>
+	- ruby3.1 <removed>
+	NOTE: https://github.com/ruby/ruby/pull/19020
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/7cfe8dc82f9f1b3f9c37c78e362fcbdf3c0b84f4 (v4.1.0-preview1)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/cf35145fc46bc278e0ab0003478fc4afe6564819 (v4.1.0-preview1)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/fa98ef030a54595d4387998b2fb48a412fc5c63c (v3_3_13)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/b03e500193371ae87dc4536d855008b42a9cd1a7 (v3_3_13)
+	NOTE: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
 CVE-2026-93529 (Contributor Broken Access Control in WSP MCP – AI Agents Connect ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93527 (Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 v ...)
@@ -45976,7 +45995,12 @@ CVE-2026-90900 (Joomla Extension - joomshaper.com - Missing CSRF Token Verificat
 CVE-2026-90899 (Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via I ...)
 	NOT-FOR-US: Joomla
 CVE-2026-89078 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
-	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
+	- ruby3.3 <unfixed>
+	- ruby3.1 <removed>
+	NOTE: https://github.com/ruby/ruby/pull/13332
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/35000ac2ed3a1829f8d193ffb23da0e44cc6fe5f (v4.0.0-preview2)
+	NOTE: Fixed by: https://github.com/ruby/ruby/commit/63d0ba80a7d7fd348423fa450a3d766091d1f3a8 (v3_3_13)
+	NOTE: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
 CVE-2026-89005 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-89004 (The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cb6248729ae19fc864cdbdf4077ac51fea2ecaa

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cb6248729ae19fc864cdbdf4077ac51fea2ecaa
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/c980d08d/attachment-0001.htm>