Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9765319b by Moritz Muehlenhoff at 2026-06-23T23:14:44+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -5597,10 +5597,12 @@ CVE-2026-XXXX [RUSTSEC-2026-0177]
NOTE: https://github.com/PyO3/pyo3/pull/6096
CVE-2026-9641 (Crypt::PBKDF2 versions before 0.261630 for Perl have a weak
default al ...)
- libcrypt-pbkdf2-perl 0.261630-1 (bug #1139867)
+ [trixie] - libcrypt-pbkdf2-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40933040/
NOTE: Fixed by:
https://github.com/arodland/Crypt-PBKDF2/commit/320db2451c42916ce787479de8a0bb1fb37a6700
(0.261630)
CVE-2026-9638 (Crypt::PBKDF2 versions before 0.261630 for Perl generate
insecure rand ...)
- libcrypt-pbkdf2-perl 0.261630-1 (bug #1139867)
+ [trixie] - libcrypt-pbkdf2-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40932643/
NOTE: Fixed by:
https://github.com/arodland/Crypt-PBKDF2/commit/1d0a1ad8474fd3dddfd10a04ea6837951f6e6519
(0.261630)
CVE-2026-9266 (A Missing Required Cryptographic Step vulnerability has been
identifie ...)
@@ -5927,6 +5929,7 @@ CVE-2026-10557 (The Yarbo Android and iOS applications
contain hard-coded MQTT b
NOT-FOR-US: Yarbo
CVE-2017-20240 (Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable
to timi ...)
- libcrypt-pbkdf2-perl 0.261630-1 (bug #1139867)
+ [trixie] - libcrypt-pbkdf2-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40929601/
NOTE: Fixed by:
https://github.com/arodland/Crypt-PBKDF2/commit/ac5aac7c8c0e411165a6665a9c1f449b745f2629
(0.261630)
CVE-2026-50012
@@ -6474,6 +6477,7 @@ CVE-2026-46643 (Snappy is a PHP library allowing
thumbnail, snapshot or PDF gene
NOT-FOR-US: Snappy PHP (different from src:snappy)
CVE-2026-46625 (JavaScript Cookie is a JavaScript API for handling cookies,
client-sid ...)
- node-js-cookie 3.0.7+~3.0.6-1
+ [trixie] - node-js-cookie <no-dsa> (Minor issue)
NOTE:
https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j
NOTE:
https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020
(v3.0.7)
CVE-2026-46519 (mcp-server-kubernetes is a Model Context Protocol server for
Kubernete ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -46,6 +46,8 @@ kitty
libheif
possibly best to move to 1.23.0
--
+libssh2 (jmm)
+--
linux (carnil)
Wait until more issues have piled up, though try to regulary rebase for point
releases to more 6.1.y versions
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9765319b6fc4b4b98a5008db1c6158157320a46b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9765319b6fc4b4b98a5008db1c6158157320a46b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
