Daniel Leidert pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7dd8321d by Daniel Leidert at 2026-06-29T02:28:31+02:00
Add notes about CVE-2026-54273/python-aiohttp
The massive rewrite of the decompression handling in v3.14.0 contains the
required logic to make the C parser work (HPE_PAUSED). Without it, the fix
cannot be completed. But it is intrusive to backport. I therefore marked the
issue as ignored for Bookworm and Bullseye. Trixie might ship with the
incomplete fix.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5491,8 +5491,12 @@ CVE-2026-54274 (AIOHTTP is an asynchronous HTTP
client/server framework for asyn
NOTE: Fixed by:
https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
(v3.14.1)
CVE-2026-54273 (AIOHTTP is an asynchronous HTTP client/server framework for
asyncio an ...)
- python-aiohttp 3.14.1-1
+ [bookworm] - python-aiohttp <ignored> (Too intrusive to backport)
+ [bullseye] - python-aiohttp <ignored> (Too intrusive to backport)
NOTE:
https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc
NOTE: Fixed by:
https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
(v3.14.1)
+ NOTE: Required code for C parser:
https://github.com/aio-libs/aiohttp/commit/b502ae655c8788b469dcc832923a85d661719699
(v3.14.0)
+ NOTE: The C parser code changes are intrusive. Without them, the C
parser can only be partially fixed.
CVE-2026-54271 (protobufjs-cli is the command line add-on for protobuf.js.
Prior to 1. ...)
NOT-FOR-US: protobufjs-cli
CVE-2026-54270 (protobufjs compiles protobuf definitions into JavaScript (JS)
function ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dd8321def32015645f0bd3568b7742a9bdf2712
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dd8321def32015645f0bd3568b7742a9bdf2712
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
