[Git][security-tracker-team/security-tracker][master] 2 commits: Add regression fix patch link for CVE-2025-69224/python-aiohttp

Daniel Leidert (@dleidert) dleidert at debian.org
Sat Oct 31 22:32:21 GMT 2026 


Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ed8d6879 by Daniel Leidert at 2026-10-31T23:22:03+01:00
Add regression fix patch link for CVE-2025-69224/python-aiohttp

- - - - -
cbb480ab by Daniel Leidert at 2026-10-31T23:32:04+01:00
Reserve DLA-4876-1 for python-aiohttp

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -215798,7 +215798,6 @@ CVE-2026-34525 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	{DLA-4613-1}
 	- python-aiohttp 3.13.5-1 (bug #1132582)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 (v3.13.4)
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000 (v3.13.5)
@@ -215818,7 +215817,6 @@ CVE-2026-34518 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	{DLA-4613-1}
 	- python-aiohttp 3.13.5-1 (bug #1132582)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6 (v3.13.4)
 CVE-2026-34517 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -215831,7 +215829,6 @@ CVE-2026-34516 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	{DLA-4613-1}
 	- python-aiohttp 3.13.5-1 (bug #1132582)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f (v3.13.4)
 CVE-2026-34515 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -215842,14 +215839,12 @@ CVE-2026-34514 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	{DLA-4613-1}
 	- python-aiohttp 3.13.5-1 (bug #1132582)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06 (v3.13.4)
 CVE-2026-34513 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	{DLA-4613-1}
 	- python-aiohttp 3.13.5-1 (bug #1132582)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98 (v3.13.4)
 CVE-2026-34456 (Reviactyl is an open-source game server management panel built using L ...)
@@ -254995,6 +254990,7 @@ CVE-2025-69224 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	- python-aiohttp 3.13.3-1
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2
 	NOTE: Fixed by: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0 (v3.13.3)
+	NOTE: Regression fix: https://github.com/aio-libs/aiohttp/commit/be0278388d206682fb246fbf550f2d003f22cf93 (master)
 CVE-2025-69226 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
 	{DSA-6241-1 DLA-4613-1}
 	- python-aiohttp 3.13.3-1
@@ -317792,7 +317788,6 @@ CVE-2025-53643 (AIOHTTP is an asynchronous HTTP client/server framework for asyn
 	{DLA-4613-1}
 	- python-aiohttp 3.12.15-1 (bug #1109336)
 	[trixie] - python-aiohttp <no-dsa> (Minor issue)
-	[bookworm] - python-aiohttp <no-dsa> (Minor issue)
 	NOTE: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
 	NOTE: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a (v3.12.14)
 CVE-2025-7628 (A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fb ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[31 Oct 2026] DLA-4876-1 python-aiohttp - security update
+	{CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226 CVE-2025-69227 CVE-2025-69228 CVE-2025-69229 CVE-2026-22815 CVE-2026-34513 CVE-2026-34514 CVE-2026-34516 CVE-2026-34517 CVE-2026-34518 CVE-2026-34519 CVE-2026-34520 CVE-2026-34525 CVE-2026-34993 CVE-2026-47265 CVE-2026-50269 CVE-2026-54274 CVE-2026-54277 CVE-2026-54279 CVE-2026-54280 CVE-2026-59881 CVE-2026-69243}
+	[bookworm] - python-aiohttp 3.8.4-1+deb12u2
 [31 Oct 2026] DLA-4875-1 imagemagick - security update
 	{CVE-2026-105081 CVE-2026-105083 CVE-2026-109259 CVE-2026-109260 CVE-2026-109262 CVE-2026-109263 CVE-2026-109264 CVE-2026-109266 CVE-2026-109267 CVE-2026-109268 CVE-2026-109269 CVE-2026-109273 CVE-2026-109275 CVE-2026-109276 CVE-2026-109278 CVE-2026-109279 CVE-2026-109964 CVE-2026-116140 CVE-2026-116143 CVE-2026-116144 CVE-2026-116145 CVE-2026-116146 CVE-2026-116147 CVE-2026-116148 CVE-2026-116149 CVE-2026-116150 CVE-2026-116151 CVE-2026-116154 CVE-2026-116155 CVE-2026-116157 CVE-2026-116159 CVE-2026-116160}
 	[bookworm] - imagemagick 8:6.9.11.60+dfsg-1.6+deb12u15


=====================================
data/dla-needed.txt
=====================================
@@ -600,10 +600,6 @@ py7zr
   NOTE: 20260709: Added by Front-Desk (utkarsh)
   NOTE: 20260709: CVE-2026-23879 (GHSA range <=1.1.2); Debian 0.11.3 in range.
 --
-python-aiohttp (dleidert)
-  NOTE: 20260611: Added by Front-Desk (rouca)
-  NOTE: 20260602: Daniel Leidert is proposing to work on the update and provide debdiffs for bookworm and trixie (carnil)
---
 python-asyncssh
   NOTE: 20260806: Added by Front-Desk (rouca)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/313283661ff4444a73463366089c3729147f406d...cbb480ab09379c0ba881ad360ee3265d8b85ad8f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/313283661ff4444a73463366089c3729147f406d...cbb480ab09379c0ba881ad360ee3265d8b85ad8f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/6cc6d1dd/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list