[Git][security-tracker-team/security-tracker][master] Track nginx update which now is routed via trixie-pu

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
667f080b by Salvatore Bonaccorso at 2026-09-04T23:00:12+02:00
Track nginx update which now is routed via trixie-pu

- - - - -


3 changed files:

- data/CVE/list
- data/dsa-needed.txt
- data/next-point-update.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -57433,6 +57433,7 @@ CVE-2026-60062 (The NGINX Agent config_dirsdirective allows a low-privileged att
 	NOT-FOR-US: F5
 CVE-2026-60005 (NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...)
 	- nginx 1.30.1-7
+	[trixie] - nginx <no-dsa> (Minor issue; will be fixed via point release)
 	NOTE: https://my.f5.com/manage/s/article/K000162100
 CVE-2026-59955 (Apollo is a reliable configuration management system suitable for micr ...)
 	NOT-FOR-US: Apollo
@@ -57507,6 +57508,7 @@ CVE-2026-56687 (Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsol
 	NOT-FOR-US: Dell / EMC
 CVE-2026-56434 (NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...)
 	- nginx 1.30.1-7
+	[trixie] - nginx <no-dsa> (Minor issue; will be fixed via point release)
 	NOTE: https://my.f5.com/manage/s/article/K000162098
 CVE-2026-56400 (open-webui before 0.3.14 contains a cross-origin resource sharing misc ...)
 	NOT-FOR-US: open-webui
@@ -57613,6 +57615,7 @@ CVE-2026-43637 (Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnera
 	NOT-FOR-US: Cornac
 CVE-2026-42533 (A vulnerability exists in NGINX Plus and NGINX Open Source when a mapd ...)
 	- nginx 1.30.4-3
+	[trixie] - nginx <no-dsa> (Minor issue; will be fixed via point release)
 	NOTE: https://my.f5.com/manage/s/article/K000162097
 CVE-2026-41580 (Stirling-PDF is a locally hosted web application that facilitates vari ...)
 	NOT-FOR-US: Stirling-PDF


=====================================
data/dsa-needed.txt
=====================================
@@ -89,9 +89,6 @@ netatalk
 --
 netty
 --
-nginx (aron)
-  Maintainer is working on updates
---
 nodejs
   Bastien Roucaries will work on updates
 --


=====================================
data/next-point-update.txt
=====================================
@@ -576,3 +576,9 @@ CVE-2026-8924
 	[trixie] - curl 8.14.1-2+deb13u6
 CVE-2026-8927
 	[trixie] - curl 8.14.1-2+deb13u6
+CVE-2026-56434
+	[trixie] - nginx 1.26.3-3+deb13u8
+CVE-2026-60005
+	[trixie] - nginx 1.26.3-3+deb13u8
+CVE-2026-42533
+	[trixie] - nginx 1.26.3-3+deb13u8



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/667f080b02cded7e9c0964670c17357929842979

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/667f080b02cded7e9c0964670c17357929842979
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260904/bce1d728/attachment-0001.htm>