[Git][security-tracker-team/security-tracker][master] auto-nfu: Update rules for wikimedia, nvidia and apache
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Sep 30 08:28:56 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9417de3e by Moritz Muehlenhoff at 2026-09-30T09:28:22+02:00
auto-nfu: Update rules for wikimedia, nvidia and apache
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -881,11 +881,11 @@ CVE-2026-102521 (The decoder in `readFromDataView` in lib0 before 0.2.119 can be
CVE-2026-102507 (Sliver C2 framework version 1.7.7 and earlier contains an unhandled pa ...)
NOT-FOR-US: Sliver C2 framework
CVE-2026-102497 (The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102496 (Apache XmlSchema doesn't limit how deeply schema structures can be nes ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102495 (Apache XmlSchema doesn't limit how deeply schema imports and includes ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102491 (A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d ...)
NOT-FOR-US: mahonelau kykms
CVE-2026-102474 (A flaw was found in dash. The printf builtin reserves four bytes befor ...)
@@ -944,15 +944,15 @@ CVE-2026-100244 (Exposure of Sensitive Information to an Unauthorized Actor vuln
CVE-2026-100243 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and Uncontrolled Resour ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100241 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100240 (Missing Authorization vulnerability in Wikimedia Foundation Mediawiki ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100238 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2025-33207 (NVIDIA ConnectX and Bluefield contain a vulnerability in a control reg ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2023-54400 (Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the Aj ...)
NOT-FOR-US: Fumasoft Fumeng Cloud
CVE-2022-51019 (Akaunting before 2.1.31 contains an OS command injection vulnerability ...)
@@ -1803,7 +1803,7 @@ CVE-2026-97335 (Incorrect authorization in the custom storage volume creation en
- lxd <removed>
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-p456-92fx-44xh
CVE-2026-96740 (A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-su ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96538 (WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing auth ...)
NOT-FOR-US: WarehousePG (WHPG)
CVE-2026-95104 (Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi prod ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -451,6 +451,7 @@
- product: Apache Traffic Control
- product: Apache Uniffle
- product: Apache Wicket
+ - product: Apache XMLSchema
- product: Apache Zeppelin
- product: Pony Mail
- reason: Check Point
@@ -643,6 +644,7 @@
- product: BioNeMo Framework
- product: 'BlueField.*'
- product: CUDA-Q
+ - product: 'ConnectX.*'
- product: Container Toolkit
- product: DALI
- product: DeepStream
@@ -651,8 +653,7 @@
- product: Dynamo
- product: FLARE SDK
- product: Infrastructure Controller
- - product: Isaac Lab
- - product: Isaac Launchable
+ - product: 'Isaac.*'
- product: KAI Scheduler
- product: 'Megatron.*'
- product: Merlin Transformers4Rec
@@ -662,11 +663,9 @@
- product: NVDebug tool
- product: NVIDIA Apex
- product: NVIDIA App
- - product: NVIDIA Isaac-GR00T N1
- - product: NVIDIA Isaac-GR00T N1.5
+ - product: 'NVIDIA Isaac*'
- product: NVIDIA Merlin Transformers4Rec
- - product: NVIDIA NeMo Curator
- - product: NVIDIA NeMo Framework
+ - product: 'NVIDIA NeMo.*'
- product: NVIDIA WebDataset
- product: NVIDIA runx
- product: NVTabular
@@ -974,10 +973,13 @@
- product: 'Mediawiki - CentralAuth.*'
- product: 'Mediawiki - Charts.*'
- product: 'Mediawiki - CirrusSearch.*'
+ - product: 'Mediawiki - DataTransfer.*'
- product: 'MediaWiki - CSS.*'
+ - product: 'Mediawiki - EventBus.*'
- product: 'Mediawiki - ExternalData.*'
- product: 'Mediawiki - ExternalGuidance.*'
- product: 'Mediawiki - FlaggedRevs.*'
+ - product: 'Mediawiki - Flow.*'
- product: 'Mediawiki - GlobalWatchlist.*'
- product: 'Mediawiki - GrowthExperiments.*'
- product: 'Mediawiki - LanguageSelector.*'
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9417de3e242d00a1400e00c2b70b7788572e3026
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9417de3e242d00a1400e00c2b70b7788572e3026
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/7ab2d746/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list