This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/sis-site.git
The following commit(s) were added to refs/heads/main by this push:
new 3d05efc8 Add links to CVE published reports.
3d05efc8 is described below
commit 3d05efc865318062f39181e72b32610a95fcbed7
Author: Martin Desruisseaux <[email protected]>
AuthorDate: Wed Oct 28 12:59:19 2026 +0100
Add links to CVE published reports.
---
content/release-notes/1.7.md | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/content/release-notes/1.7.md b/content/release-notes/1.7.md
index 0f505394..5f55a1db 100644
--- a/content/release-notes/1.7.md
+++ b/content/release-notes/1.7.md
@@ -39,11 +39,14 @@ Note that when Apache SIS opens another file, it tries to
parse it as GML, GeoTI
format and fails at the first error. Therefore, these vulnerabilities are
unlikely to leak sensitive
information (unless passwords are saved as TIFF images…).
-* CWE-918 SSRF and local-file disclosure via `xlink:href` resolution during
XML unmarshalling (reporters: n0mi1k, Ho1aAs).
-* CWE-918 SSRF via datum-shift grid-file references such as URI parameter in
WKT (reporters: n0mi1k, Ho1aAs).
-* CWE-22 path traversal / arbitrary file read via Landsat metadata band
filenames (reporters: n0mi1k, Ho1aAs).
+* [CVE-2026-110748](https://www.cve.org/CVERecord?id=CVE-2026-110748) —
+ Improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
+ * CWE-918 SSRF and local-file disclosure via `xlink:href` resolution during
XML unmarshalling (reporters: n0mi1k, Ho1aAs).
+ * CWE-918 SSRF via datum-shift grid-file references such as URI parameter in
WKT (reporters: n0mi1k, Ho1aAs).
+ * CWE-22 path traversal / arbitrary file read via Landsat metadata band
filenames (reporters: n0mi1k, Ho1aAs).
+* [CVE-2026-110733](https://www.cve.org/CVERecord?id=CVE-2026-110733) —
+ SQL injection via unvalidated `ORDER BY` sort expression in the SQL feature
store (reporter: Ho1aAs).
* CWE-770 unbounded memory allocation in the binary file parsers (netCDF +
GeoTIFF) leading to DoS (reporter: n0mi1k).
-* SQL injection via unvalidated `ORDER BY` sort expression in the SQL feature
store (reporter: Ho1aAs).
The following vulnerability has not been fixed by code.
Instead, it is addressed by documenting recommendations:
