[Git][security-tracker-team/security-tracker][master] Add new python-autobahn issue

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d3dcf0f9 by Salvatore Bonaccorso at 2026-10-27T17:32:25+01:00
Add new python-autobahn issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -446,7 +446,10 @@ CVE-2026-116581 (Seroval facilitates JavaScript value stringification, including
 CVE-2026-116580 (Seroval facilitates JavaScript value stringification, including comple ...)
 	TODO: check
 CVE-2026-116579 (Autobahn Python is a WebSocket and WAMP implementation for Python that ...)
-	TODO: check
+	- python-autobahn <not-affected> (Incomplete fix for CVE-2026-77528 not applied)
+	NOTE: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-pjh6-c8mg-3x7m
+	NOTE: https://github.com/crossbario/autobahn-python/pull/1987
+	NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1 (v26_10_1)
 CVE-2026-116578 (Tornado is a Python web framework and asynchronous networking library. ...)
 	TODO: check
 CVE-2026-116577 (Tornado is a Python web framework and asynchronous networking library. ...)
@@ -52346,6 +52349,7 @@ CVE-2026-77528 (Autobahn Python is a WebSocket and WAMP implementation for Pytho
 	NOTE: https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
 	NOTE: https://github.com/crossbario/autobahn-python/pull/1916
 	NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613 (v26.7.1)
+	NOTE: When fixing this issue make sure to make the fix complete to not open up CVE-2026-116579
 CVE-2026-76902 (CordysCRM is an open source AI-powered customer relationship managemen ...)
 	NOT-FOR-US: CordysCRM
 CVE-2026-76901 (CordysCRM is an open source AI-powered customer relationship managemen ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3dcf0f93557415b1a49c5552977f9c71a93c4f7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3dcf0f93557415b1a49c5552977f9c71a93c4f7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/259d05c1/attachment.htm>