[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Oct 27 19:44:20 GMT 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c03c1487 by Salvatore Bonaccorso at 2026-10-27T20:42:14+01:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1140,56 +1140,56 @@ CVE-2026-65686
 CVE-2026-65685
 	REJECTED
 CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS s ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65632.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65632
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf (1.11.13)
 CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an unauthenti ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-3m45-vrpj-xmrq
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65631.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65631
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/d19e1ba68d88c68d29aa942be2573a22dbafca1f (1.7.7)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/bfd336c0062bff93e65d08c22361897e96afd956 (1.11.13)
 CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad jose allows ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65630.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65630
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/8e532095de114ef4bf88a9ec5d651fa251a972b3 (1.10.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79 (1.11.13)
 CVE-2026-65629 (Use of Password Hash With Insufficient Computational Effort in the jos ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65629.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65629
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 (1.10.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0 (1.11.13)
 CVE-2026-65628 (jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/ ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65628.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65628
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/7b80b9f55b9898e1a6901ce136061b241b021d7c (1.5.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a (1.11.13)
 CVE-2026-65627 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65627.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65627
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad (1.11.13)
 CVE-2026-65626 (The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 modu ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-vwvr-f994-6j9j
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65626.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65626
 	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/853c5d4c4c0bd2a7ecb055b237f4284184e176c8 (1.3.0)
 	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/0eac8cef9aaa48fb6846f4e47a0002dc4a73966d (1.11.13)
 CVE-2026-65625 (The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of ...)
-	- erlang-jose <unfixed>
+	- erlang-jose <unfixed> (bug #1152299)
 	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6
 	NOTE: https://cna.erlef.org/cves/CVE-2026-65625.html
 	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65625
@@ -1325,16 +1325,16 @@ CVE-2026-116806 (OpenPanel before 3.0.0 contains a missing authorization vulnera
 CVE-2026-116805 (OpenPanel before 3.0.0 contains an information disclosure vulnerabilit ...)
 	NOT-FOR-US: OpenPanel
 CVE-2026-116804 (DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypas ...)
-	- node-dompurify <unfixed>
+	- node-dompurify <unfixed> (bug #1152298)
 	[trixie] - node-dompurify <not-affected> (Vulnerable code introduced in 3.4.4 upstream)
 	[bookworm] - node-dompurify <not-affected> (Vulnerable code introduced in 3.4.4 upstream)
 	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
 CVE-2026-116803 (DOMPurify before 3.4.17 contains a cross-site scripting vulnerability  ...)
-	- node-dompurify <unfixed>
+	- node-dompurify <unfixed> (bug #1152298)
 	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr
 	NOTE: Issue exists because of an incomplete fix for CVE-2026-109344 / GHSA-p98j-92pf-mc4p
 CVE-2026-116802 (DOMPurify before 3.4.17 contains a cross-site scripting vulnerability  ...)
-	- node-dompurify <unfixed>
+	- node-dompurify <unfixed> (bug #1152298)
 	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-c6gr-qvv4-5v3f
 CVE-2026-116801 (Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not v ...)
 	NOT-FOR-US: Parse Server
@@ -1447,14 +1447,14 @@ CVE-2026-116579 (Autobahn Python is a WebSocket and WAMP implementation for Pyth
 	NOTE: https://github.com/crossbario/autobahn-python/pull/1987
 	NOTE: Fixed by: https://github.com/crossbario/autobahn-python/commit/a41442bbee4f6126a8ce1bb892840124c24d16f1 (v26_10_1)
 CVE-2026-116578 (Tornado is a Python web framework and asynchronous networking library. ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1152300)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
 	NOTE: https://github.com/tornadoweb/tornado/pull/3786
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233 (v6.6.0b1)
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117 (v6.6.0rc1)
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035 (v6.6.0rc1)
 CVE-2026-116577 (Tornado is a Python web framework and asynchronous networking library. ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1152300)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c
 	NOTE: https://github.com/tornadoweb/tornado/pull/3765
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9 (v6.6.0b1)
@@ -1493,7 +1493,7 @@ CVE-2026-116478 (A vulnerability was detected in a2aproject a2a-go up to 2.4.0.
 CVE-2026-116477 (A security vulnerability has been detected in a2aproject a2a-dotnet up ...)
 	TODO: check
 CVE-2026-115927 (Tornado is a Python web framework and asynchronous networking library. ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1152300)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985
 	NOTE: https://github.com/tornadoweb/tornado/pull/3773
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8 (v6.6.0b1)
@@ -2231,19 +2231,19 @@ CVE-2026-116544 (Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vuln
 CVE-2026-116543 (Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulner ...)
 	- open5gs <itp> (bug #1094791)
 CVE-2026-116542 (Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoo ...)
-	- netty-tcnative <unfixed>
+	- netty-tcnative <unfixed> (bug #1152301)
 	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf
 	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116541 (Netty netty-tcnative before 2.0.84.Final contains a denial of service  ...)
-	- netty-tcnative <unfixed>
+	- netty-tcnative <unfixed> (bug #1152301)
 	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489
 	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116540 (netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL  ...)
-	- netty-tcnative <unfixed>
+	- netty-tcnative <unfixed> (bug #1152301)
 	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
 	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116539 (Netty netty-tcnative before 2.0.84.Final contains a heap buffer overfl ...)
-	- netty-tcnative <unfixed>
+	- netty-tcnative <unfixed> (bug #1152301)
 	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh
 	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116538 (HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-be ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c03c1487b645000b7d02cd0b28c5ead6414e0f81

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c03c1487b645000b7d02cd0b28c5ead6414e0f81
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/a9ee3249/attachment.htm>

More information about the debian-security-tracker-commits mailing list