[Git][security-tracker-team/security-tracker][master] 2 commits: PyPy3 CVEs fixed in stdlib v3.11.17

[Stefano Rivera (@stefanor)]

Stefano Rivera pushed to branch master at Debian Security Tracker / security-tracker


Commits:
51f7eadb by Stefano Rivera at 2026-10-27T19:38:49+00:00
PyPy3 CVEs fixed in stdlib v3.11.17

- - - - -
15499542 by Stefano Rivera at 2026-10-28T04:06:29+00:00
Merge branch 'pypy-cves' into 'master'

PyPy3 CVEs fixed in stdlib v3.11.17

See merge request security-tracker-team/security-tracker!335
- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -41526,7 +41526,7 @@ CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname arg
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <removed>
-	- pypy3 <unfixed> (bug #1150803)
+	- pypy3 8.0.1+dfsg-1 (bug #1150803)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://github.com/python/cpython/issues/156793
@@ -41840,7 +41840,7 @@ CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <removed>
-	- pypy3 <unfixed> (bug #1150805)
+	- pypy3 8.0.1+dfsg-1 (bug #1150805)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://github.com/python/cpython/issues/156293
@@ -65711,7 +65711,7 @@ CVE-2026-82049 (In CPython 3.13 and earlier, the tarfilemodule's dataand tar ext
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
-	- pypy3 <unfixed> (bug #1151858)
+	- pypy3 8.0.1+dfsg-1 (bug #1151858)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <not-affected> (extraction filters (PEP 706) absent in stdlib 3.9.16)
 	NOTE: https://github.com/python/cpython/issues/157190
@@ -69209,7 +69209,7 @@ CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support li
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
 	- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
-	- pypy3 <unfixed>
+	- pypy3 8.0.1+dfsg-1
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <not-affected> (extraction filters (PEP 706) absent in stdlib 3.9.16)
 	NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
@@ -98657,7 +98657,7 @@ CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454
 	- python3.9 <removed>
 	- python2.7 <removed>
 	[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
-	- pypy3 <unfixed> (bug #1147445)
+	- pypy3 8.0.1+dfsg-1 (bug #1147445)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/
@@ -98678,7 +98678,7 @@ CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along wi
 	- python3.9 <removed>
 	- python2.7 <removed>
 	[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
-	- pypy3 <unfixed> (bug #1147448)
+	- pypy3 8.0.1+dfsg-1 (bug #1147448)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/
@@ -111233,7 +111233,7 @@ CVE-2026-18503 (Attacker-controlled CSV samples can trigger super-linear  regula
 	- python3.9 <removed>
 	- python2.7 <removed>
 	[bullseye] - python2.7 <end-of-life> (EOL in bullseye LTS)
-	- pypy3 <unfixed> (bug #1147450)
+	- pypy3 8.0.1+dfsg-1 (bug #1147450)
 	[trixie] - pypy3 <no-dsa> (Minor issue)
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/8cda9737041b81f240a93f91d4eedf5fd37b3f62...15499542d4fea6a878be53dad90f53dd378e3709

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/8cda9737041b81f240a93f91d4eedf5fd37b3f62...15499542d4fea6a878be53dad90f53dd378e3709
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/94df783a/attachment-0001.htm>