[Git][security-tracker-team/security-tracker][master] Track fixed version for python3.13 issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 28 15:34:32 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
411cff53 by Salvatore Bonaccorso at 2026-10-28T16:34:01+01:00
Track fixed version for python3.13 issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4653,7 +4653,7 @@ CVE-2026-115932 (When a post is published, Postiz treats a media path that is no
CVE-2026-115557 (Python has added a denylist for known compromised certificates to the ...)
- python3.15 3.15.2-1 (unimportant)
- python3.14 3.14.10-1 (unimportant)
- - python3.13 <unfixed> (unimportant)
+ - python3.13 3.13.18-1 (unimportant)
- python3.11 <removed> (unimportant)
NOTE: https://github.com/python/cpython/issues/160040
NOTE: https://github.com/python/cpython/pull/160042
@@ -6908,7 +6908,7 @@ CVE-2026-114603 (OpenTelemetry Python provides the Python API and SDK for OpenTe
CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries, inclu ...)
- python3.15 3.15.1-1
- python3.14 3.14.9-1
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- jython <unfixed>
@@ -42101,7 +42101,7 @@ CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname arg
{DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- pypy3 8.0.1+dfsg-1 (bug #1150803)
@@ -42415,7 +42415,7 @@ CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or
{DLA-4827-1}
- python3.15 3.15.0~rc3-1
- python3.14 3.14.8-1
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- pypy3 8.0.1+dfsg-1 (bug #1150805)
@@ -43220,7 +43220,7 @@ CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP re
CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a race con ...)
- python3.15 3.15.0~rc3-1
- python3.14 3.14.9-1
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
[bookworm] - python3.11 <postponed> (Minor issue)
@@ -66289,7 +66289,7 @@ CVE-2026-12758 (IBM Cloud Pak for Business Automation could allow a remote attac
CVE-2026-12756 (IBM Business Automation Workflow containers and traditional is vulnera ...)
NOT-FOR-US: IBM
CVE-2026-82049 (In CPython 3.13 and earlier, the tarfilemodule's dataand tar extractio ...)
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- pypy3 8.0.1+dfsg-1 (bug #1151858)
@@ -69787,7 +69787,7 @@ CVE-2026-87983 (An arbitrary file read vulnerability in Mistral Vibe, introduced
CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support links, i ...)
- python3.15 3.15.0~rc3-1
- python3.14 3.14.9-1
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- pypy3 8.0.1+dfsg-1
@@ -90470,7 +90470,7 @@ CVE-2026-15310 (When decompressing crafted zip files using the bzip/LZMA/Zstanda
{DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- python3.9 <removed>
@@ -95696,7 +95696,7 @@ CVE-2026-19875 (IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attac
CVE-2026-19672 (The tarfile module's tar and data extraction filters created director ...)
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <not-affected> (extraction filters (PEP 706) absent in 3.11.2)
- python3.9 <not-affected> (extraction filters (PEP 706) absent in 3.9.2)
@@ -99232,7 +99232,7 @@ CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454
{DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- python3.9 <removed>
@@ -99253,7 +99253,7 @@ CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along wi
{DLA-4827-1}
- python3.15 3.15.0~rc2-1
- python3.14 3.14.7-3
- - python3.13 <unfixed>
+ - python3.13 3.13.18-1
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- python3.9 <removed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/411cff53878d22ac0214c43d7fc109fa414c8226
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/411cff53878d22ac0214c43d7fc109fa414c8226
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/a44db82f/attachment.htm>
More information about the debian-security-tracker-commits
mailing list