[Git][security-tracker-team/security-tracker][master] new go jose security issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
dc6924cb by Moritz Muehlenhoff at 2026-10-30T09:50:25+01:00
new go jose security issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -6510,11 +6510,28 @@ CVE-2026-116589 (Datadog dd-trace-py is the Datadog Python APM client. From 3.13
 CVE-2026-116588 (Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until ...)
 	NOT-FOR-US: dd-trace-py
 CVE-2026-116587 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
-	TODO: check
+	- golang-github-go-jose-go-jose <unfixed>
+	- golang-github-go-jose-go-jose.v3 <unfixed>
+	- golang-gopkg-square-go-jose.v2 <unfixed>
+	- golang-gopkg-square-go-jose.v1 <unfixed>
+	NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q
+	NOTE: https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230 (v4.1.6)
 CVE-2026-116586 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
-	TODO: check
+	- golang-github-go-jose-go-jose <unfixed>
+	- golang-github-go-jose-go-jose.v3 <unfixed>
+	- golang-gopkg-square-go-jose.v2 <unfixed>
+	- golang-gopkg-square-go-jose.v1 <unfixed>
+	NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
+	NOTE: https://github.com/go-jose/go-jose/pull/290
+	NOTE: https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a (v4.1.5)
 CVE-2026-116585 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
-	TODO: check
+	- golang-github-go-jose-go-jose <unfixed>
+	- golang-github-go-jose-go-jose.v3 <unfixed>
+	- golang-gopkg-square-go-jose.v2 <unfixed>
+	- golang-gopkg-square-go-jose.v1 <unfixed>
+	NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q
+	NOTE: https://github.com/go-jose/go-jose/pull/292
+	NOTE: https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54 (v4.1.5)
 CVE-2026-116584 (Seroval facilitates JavaScript value stringification, including comple ...)
 	NOT-FOR-US: Node seroval
 CVE-2026-116583 (Seroval facilitates JavaScript value stringification, including comple ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc6924cb6a9366cafcedd25f9ccca4f46688c464

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc6924cb6a9366cafcedd25f9ccca4f46688c464
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/75132b8b/attachment.htm>