[Git][security-tracker-team/security-tracker][master] Add more erlang-jose issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9be4e817 by Salvatore Bonaccorso at 2026-10-27T15:32:08+01:00
Add more erlang-jose issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -162,15 +162,40 @@ CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512)
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf (1.11.13)
 CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an unauthenti ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-3m45-vrpj-xmrq
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65631.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65631
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/d19e1ba68d88c68d29aa942be2573a22dbafca1f (1.7.7)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/bfd336c0062bff93e65d08c22361897e96afd956 (1.11.13)
 CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad jose allows ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65630.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65630
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/8e532095de114ef4bf88a9ec5d651fa251a972b3 (1.10.0)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79 (1.11.13)
 CVE-2026-65629 (Use of Password Hash With Insufficient Computational Effort in the jos ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65629.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65629
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 (1.10.0)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0 (1.11.13)
 CVE-2026-65628 (jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/ ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65628.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65628
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/7b80b9f55b9898e1a6901ce136061b241b021d7c (1.5.0)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a (1.11.13)
 CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65627.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65627
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad (1.11.13)
 CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 modu ...)
 	TODO: check
 CVE-2026-65625 (The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9be4e817b331824d86ece8b2f5c1b8bb106394d1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9be4e817b331824d86ece8b2f5c1b8bb106394d1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/8af7d048/attachment-0001.htm>