[Git][security-tracker-team/security-tracker][master] Reserve DLA-4872-1 for python-git

[Emmanuel Arias (@eamanu)]

Emmanuel Arias pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1ff721a5 by Emmanuel Arias at 2026-10-30T20:01:38-03:00
Reserve DLA-4872-1 for python-git

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[30 Oct 2026] DLA-4872-1 python-git - security update
+	{CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244 CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325 CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620 CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624 CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219 CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675 CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679 CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689 CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858 CVE-2026-110859 CVE-2026-110860 CVE-2026-114145}
+	[bookworm] - python-git 3.1.30-1+deb12u3
 [30 Oct 2026] DLA-4871-1 cyrus-sasl2 - security update
 	{CVE-2026-107161}
 	[bookworm] - cyrus-sasl2 2.1.28+dfsg-10+deb12u1


=====================================
data/dla-needed.txt
=====================================
@@ -636,26 +636,6 @@ python-geopandas
   NOTE: 20260725: Should be fixed for trixie too, which still ships an
   NOTE: 20260725: affected 1.0.1-2. (utkarsh/front-desk)
 --
-python-git (eamanu)
-  NOTE: 20260726: Added by Front-Desk (utkarsh)
-  NOTE: 20260726: CVE-2026-42215 bypasses the check_unsafe_options guard
-  NOTE: 20260726: that DLA-3939-1 itself backported, so our own earlier fix
-  NOTE: 20260726: is incomplete; same class as CVE-2023-40267 (DLA-3502-1,
-  NOTE: 20260726: DLA-3939-1). Sponsored in both LTS suites and the code is
-  NOTE: 20260726: shared, so one backport serves both.
-  NOTE: 20260726: Also fix CVE-2026-42284, CVE-2026-44243 and CVE-2026-44244
-  NOTE: 20260726: in the same upload; upstream fixes are in 3.1.47, 3.1.48
-  NOTE: 20260726: and 3.1.49.
-  NOTE: 20260726: bullseye ships 3.1.14-1+deb11u1 and is affected despite
-  NOTE: 20260726: being below the upstream >= 3.1.30 range, because
-  NOTE: 20260726: DLA-3939-1 backported the guard in its pre-3.1.47 form.
-  NOTE: 20260726: Should be fixed for trixie too, which still ships an
-  NOTE: 20260726: affected 3.1.44-1. (utkarsh/front-desk)
-  NOTE: 20260918: have identified all patches for CVE, now start working in patches (eamanu)
-  NOTE: 20261014: patches sent to sec-team to review (eamanu)
-  NOTE: 20261016: sec team approved the patches, but I'm working in a new set of CVEs (eamanu)
-  NOTE: 20261029: trixie-security uploaded, patches sent to review for bookworm (eamanu)
---
 python-msgpack (dleidert)
   NOTE: 20260709: Added by Front-Desk (utkarsh)
   NOTE: 20260709: CVE-2026-57585 (fixed 1.2.1; <=1.2.0 affected); Debian 1.0.x.



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1ff721a59b53d0316143dec14d967b9d32749569

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1ff721a59b53d0316143dec14d967b9d32749569
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/2288d372/attachment-0001.htm>