[Git][security-tracker-team/security-tracker][master] auto-nfu: Extend and simplify wikimedia rule
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Sep 30 22:52:25 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7f973153 by Moritz Muehlenhoff at 2026-09-30T23:51:53+02:00
auto-nfu: Extend and simplify wikimedia rule
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -664,23 +664,23 @@ CVE-2026-103471 (restbed through 5.0.0 buffers HTTP request headers without enfo
CVE-2026-103470 (In Internet2 Grouper before 7.5.1 (in some configurations), a user who ...)
NOT-FOR-US: Internet2 Grouper
CVE-2026-103446 (Authorization bypass through User-Controlled key vulnerability in The ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103445 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103444 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103443 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
TODO: check
CVE-2026-103442 (External control of system or configuration setting vulnerability in T ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103441 (Deserialization of untrusted data vulnerability in The Wikimedia Found ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103440 (Exposure of sensitive information through data queries vulnerability i ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103439 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
TODO: check
CVE-2026-103438 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103437 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
TODO: check
CVE-2026-103436 (apcupsd through 3.14.14 discloses uninitialized stack memory in getups ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -962,52 +962,53 @@
allOf:
- cna: wikimedia-foundation
- anyOf:
- - product: CheckUser
- - product: 'MediaWiki CookieConsent.*'
- - product: 'MediaWiki GlobalBlocking.*'
- - product: 'MediaWiki PageForms.*'
- - product: 'MediaWiki WatchAnalytics.*'
- - product: 'Mediawiki - ApprovedRevs.*'
- - product: 'Mediawiki - CampaignEvents.*'
- - product: 'Mediawiki - Cargo.*'
- - product: 'Mediawiki - CentralAuth.*'
- - product: 'Mediawiki - Charts.*'
- - product: 'Mediawiki - CirrusSearch.*'
- - product: 'Mediawiki - DataTransfer.*'
- - product: 'MediaWiki - CSS.*'
- - product: 'Mediawiki - EventBus.*'
- - product: 'Mediawiki - ExternalData.*'
- - product: 'Mediawiki - ExternalGuidance.*'
- - product: 'Mediawiki - FlaggedRevs.*'
- - product: 'Mediawiki - Flow.*'
- - product: 'Mediawiki - GlobalWatchlist.*'
- - product: 'Mediawiki - GrowthExperiments.*'
- - product: 'Mediawiki - LanguageSelector.*'
- - product: 'Mediawiki - LastModified.*'
- - product: 'Mediawiki - Lockdown.*'
- - product: 'Mediawiki - Monaco.*'
- - product: 'Mediawiki - PageTriage.*'
- - product: 'MediaWiki - ProofreadPage.*'
- - product: 'Mediawiki - RedirectManager.*'
- - product: 'MediaWiki - ReportIncident.*'
- - product: 'Mediawiki - Score.*'
- - product: 'Mediawiki - TemplateSandbox.*'
- - product: 'Mediawiki - Thanks.*'
- - product: 'Mediawiki - Translate.*'
- - product: 'Mediawiki - UserPageViewTracker.*'
- - product: 'Mediawiki - UploadWizard.*'
- - product: 'Mediawiki - UrlShortener.*'
- - product: 'MediaWiki - VisualData.*'
- - product: 'Mediawiki - Wikibase.*'
- - product: 'Mediawiki - WikiLambda.*'
- - product: 'Mediawiki - WikiLove.*'
- - product: 'Mediawiki - Wikilove.*'
- - product: 'Mediawiki - WikiSEO.*'
- - product: 'Mediawiki - Wikistories.*'
+ - product: '.*ApprovedRevs.*'
+ - product: '.*CSS.*'
+ - product: '.*CampaignEvents.*'
+ - product: '.*Cargo.*'
+ - product: '.*CentralAuth.*'
+ - product: '.*Charts.*'
+ - product: '.*CheckUser.*'
+ - product: '.*CirrusSearch.*'
+ - product: '.*CookieConsent.*'
+ - product: '.*DataTransfer.*'
+ - product: '.*EventBus.*'
+ - product: '.*ExternalData.*'
+ - product: '.*ExternalGuidance.*'
+ - product: '.*FlaggedRevs.*'
+ - product: '.*Flow.*'
+ - product: '.*GlobalBlocking.*'
+ - product: '.*GlobalWatchlist.*'
+ - product: '.*GrowthExperiments.*'
+ - product: '.*LanguageSelector.*'
+ - product: '.*LastModified.*'
+ - product: '.*Lockdown.*'
+ - product: '.*Monaco.*'
+ - product: '.*OAuth.*'
+ - product: '.*PageForms.*'
+ - product: '.*Page_Forms.*'
+ - product: '.*PageTriage.*'
+ - product: '.*ProofreadPage.*'
+ - product: '.*RedirectManager.*'
+ - product: '.*ReportIncident.*'
+ - product: '.*Score.*'
+ - product: '.*TemplateSandbox.*'
+ - product: '.*Thanks.*'
+ - product: '.*Translate.*'
+ - product: '.*UploadWizard.*'
+ - product: '.*UrlShortener.*'
+ - product: '.*UserPageViewTracker.*'
+ - product: '.*VisualData.*'
+ - product: '.*WatchAnalytics.*'
+ - product: '.*WikiForum.*'
+ - product: '.*WikiLambda.*'
+ - product: '.*WikiLove.*'
+ - product: '.*WikiSEO.*'
+ - product: '.*Wikibase.*'
+ - product: '.*Wikilove.*'
+ - product: '.*Wikistories.*'
- product: Wikipedia Android App
- - product: OAuth
- product: timeline
- - product: UrlShortener
# Description based rules
- reason: Advantech
description: '.*\bAdvantech\b.*'
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7f9731532f3c94d95441dece050bf91610b347b4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7f9731532f3c94d95441dece050bf91610b347b4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/e81e37aa/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list