[Git][security-tracker-team/security-tracker][master] Track fixes for python3.15 via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Sep 3 04:53:38 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c4109941 by Salvatore Bonaccorso at 2026-09-03T05:53:28+02:00
Track fixes for python3.15 via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -8981,7 +8981,7 @@ CVE-2026-16233 (There is a memory corruption vulnerability recently discovered i
CVE-2026-16231 (hbs is an Express view engine that wraps Handlebars. Its registerAsync ...)
TODO: check
CVE-2026-15310 (When decompressing crafted zip files using the bzip/LZMA/Zstandard c ...)
- - python3.15 <unfixed>
+ - python3.15 3.15.0~rc2-1
- python3.14 <unfixed>
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -8991,6 +8991,7 @@ CVE-2026-15310 (When decompressing crafted zip files using the bzip/LZMA/Zstanda
NOTE: https://github.com/python/cpython/issues/156002
NOTE: https://github.com/python/cpython/pull/156003
NOTE: https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4 (main)
+ NOTE: https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8 (v3.15.0rc2)
CVE-2026-13478 (The Zephyr ext2 filesystem driver validates the on-disk block bitmap i ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13217 (The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a sessi ...)
@@ -14108,7 +14109,7 @@ CVE-2026-20030 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-19875 (IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to ...)
NOT-FOR-US: IBM
CVE-2026-19672 (The tarfile module's tar and data extraction filters created director ...)
- - python3.15 <unfixed>
+ - python3.15 3.15.0~rc2-1
- python3.14 <unfixed>
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -14119,7 +14120,7 @@ CVE-2026-19672 (The tarfile module's tar and data extraction filters created di
NOTE: https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/
NOTE: https://github.com/python/cpython/issues/155999
NOTE: https://github.com/python/cpython/pull/156000
- NOTE: https://github.com/python/cpython/pull/156040 (3.15)
+ NOTE: https://github.com/python/cpython/commit/038a0915fdbb872f8064c37e67e527a8a7c5236c (v3.15.0rc2)
NOTE: https://github.com/python/cpython/commit/16dea1e887ec7dfbed735beedd476b21dcc91a79 (3.14 branch)
NOTE: https://github.com/python/cpython/commit/c7979f3a819011a3222bd16e671264b1e34282cb (3.13 branch)
NOTE: https://github.com/python/cpython/commit/a5bfd964c71de4e8dfec59d28060bff1402baa21 (3.12 branch)
@@ -17599,7 +17600,7 @@ CVE-2026-17106 (The tar extraction routines in moby/go-archive (Unpack, UnpackLa
- golang-github-moby-go-archive 0.3.3-1 (bug #1145200)
NOTE: https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454 tables ...)
- - python3.15 <unfixed>
+ - python3.15 3.15.0~rc2-1
- python3.14 <unfixed>
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -17613,11 +17614,11 @@ CVE-2026-17084 (The "stringprep" module didn't process characters from RFC 3454
NOTE: https://github.com/python/cpython/issues/155292
NOTE: https://github.com/python/cpython/pull/155293
NOTE: Fixed by: https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc (main)
- NOTE: Fixed by: https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 (3.15 branch)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7 (v3.15.0rc2)
CVE-2026-16309 (Authorization bypass through User-Controlled key vulnerability in Neti ...)
NOT-FOR-US: EdoWEB
CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along with its ...)
- - python3.15 <unfixed>
+ - python3.15 3.15.0~rc2-1
- python3.14 <unfixed>
- python3.13 <unfixed>
[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -17631,7 +17632,7 @@ CVE-2026-15806 (The HTTPPasswordMgr class in the urllib.request module, along wi
NOTE: https://github.com/python/cpython/issues/155694
NOTE: https://github.com/python/cpython/pull/155696
NOTE: Fixed by: https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce (main)
- NOTE: Fixed by: https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6 (3.15 branch)
+ NOTE: Fixed by: https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6 (v3.15.0rc2)
NOTE: Fixed by: https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8 (3.14 branch)
NOTE: Fixed by: https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce (3.13 branch)
CVE-2026-15585 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c41099418206ea769ddd2eea00db9ba60c870972
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c41099418206ea769ddd2eea00db9ba60c870972
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260903/548e00a5/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list