{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "curl", "libaudit-common", "libaudit1", "libcurl4", "libexpat1", "libisns0", "libssl3", "openssl", "python3-jwt", "python3-requests" ] } }, "diff": { "deb": [ { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cocharn ]", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,", " tests/data/test1136, tests/data/test2318.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY REGRESSION: checksrc errors and failing test case for", " CVE-2026-8927 (LP #2167779)", " - debian/patches/CVE-2026-6429.patch: Fix indentation to fix", " autopkgtests in lib/transfer.c.", " - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix", " indentation to fix autopkgtests in lib/curl_sasl.c.", " - debian/patches/CVE-2026-8932.patch: Wrap long lines to fix", " autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.", " - debian/patches/CVE-2026-8927.patch: Fix failing test", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Fri, 18 Sep 2026 11:47:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit-common", "from_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1build1", "version": "1:3.0.7-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1ubuntu0.1", "version": "1:3.0.7-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:3.0.7-1ubuntu0.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Tue, 14 Jul 2026 17:13:46 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libaudit1", "from_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1build1", "version": "1:3.0.7-1build1" }, "to_version": { "source_package_name": "audit", "source_package_version": "1:3.0.7-1ubuntu0.1", "version": "1:3.0.7-1ubuntu0.1" }, "cves": [], "launchpad_bugs_fixed": [ 1117804 ], "changes": [ { "cves": [], "log": [ "", " * Fix AppArmor AVC events not appearing in `ausearch` (LP: #1117804)", " - d/p/lp1117804-audit-ausearch-do-not-require-tclass.patch", "" ], "package": "audit", "version": "1:3.0.7-1ubuntu0.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 1117804 ], "author": "Alex Ramírez ", "date": "Tue, 14 Jul 2026 17:13:46 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.27", "version": "7.81.0-1ubuntu1.27" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-6429", "url": "https://ubuntu.com/security/CVE-2026-6429", "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.", "cve_priority": "medium", "cve_public_date": "2026-05-13 13:01:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8932", "url": "https://ubuntu.com/security/CVE-2026-8932", "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cocharn ]", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,", " tests/data/test1136, tests/data/test2318.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY REGRESSION: checksrc errors and failing test case for", " CVE-2026-8927 (LP #2167779)", " - debian/patches/CVE-2026-6429.patch: Fix indentation to fix", " autopkgtests in lib/transfer.c.", " - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix", " indentation to fix autopkgtests in lib/curl_sasl.c.", " - debian/patches/CVE-2026-8932.patch: Wrap long lines to fix", " autopkgtests in lib/url.c, lib/vtls/nss.c, and lib/vtls/openssl.c.", " - debian/patches/CVE-2026-8927.patch: Fix failing test", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.29", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Fri, 18 Sep 2026 11:47:53 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libexpat1", "from_version": { "source_package_name": "expat", "source_package_version": "2.4.7-1ubuntu0.8", "version": "2.4.7-1ubuntu0.8" }, "to_version": { "source_package_name": "expat", "source_package_version": "2.4.7-1ubuntu0.9", "version": "2.4.7-1ubuntu0.9" }, "cves": [ { "cve": "CVE-2026-56410", "url": "https://ubuntu.com/security/CVE-2026-56410", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56406", "url": "https://ubuntu.com/security/CVE-2026-56406", "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56409", "url": "https://ubuntu.com/security/CVE-2026-56409", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56407", "url": "https://ubuntu.com/security/CVE-2026-56407", "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56411", "url": "https://ubuntu.com/security/CVE-2026-56411", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56131", "url": "https://ubuntu.com/security/CVE-2026-56131", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-56132", "url": "https://ubuntu.com/security/CVE-2026-56132", "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-72522", "url": "https://ubuntu.com/security/CVE-2026-72522", "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.", "cve_priority": "medium", "cve_public_date": "2026-08-10 04:16:00 UTC" }, { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-56410", "url": "https://ubuntu.com/security/CVE-2026-56410", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56406", "url": "https://ubuntu.com/security/CVE-2026-56406", "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56409", "url": "https://ubuntu.com/security/CVE-2026-56409", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56407", "url": "https://ubuntu.com/security/CVE-2026-56407", "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "cve_priority": "medium", "cve_public_date": "2026-06-21 16:16:00 UTC" }, { "cve": "CVE-2026-56411", "url": "https://ubuntu.com/security/CVE-2026-56411", "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.", "cve_priority": "medium", "cve_public_date": "2026-06-21 17:16:00 UTC" }, { "cve": "CVE-2026-56131", "url": "https://ubuntu.com/security/CVE-2026-56131", "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-56132", "url": "https://ubuntu.com/security/CVE-2026-56132", "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.", "cve_priority": "medium", "cve_public_date": "2026-06-19 06:17:00 UTC" }, { "cve": "CVE-2026-72522", "url": "https://ubuntu.com/security/CVE-2026-72522", "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.", "cve_priority": "medium", "cve_public_date": "2026-08-10 04:16:00 UTC" }, { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from", " integer overflow in expat/xmlwf/xmlfile.c.", " - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in", " resolveSystemId length sum in expat/xmlwf/xmlfile.c.", " - CVE-2026-56410", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from", " `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.", " - CVE-2026-56406", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from", " integer overflow in expat/xmlwf/xmlwf.c.", " - CVE-2026-56409", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed", " integer overflow in expat/lib/xmlparse.c.", " - CVE-2026-56407", " * SECURITY UPDATE: integer overflow", " - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list", " allocation from integer overflow in expat/xmlwf/xmlwf.c.", " - CVE-2026-56411", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from", " being called from a handler in expat/lib/xmlparse.c,", " expat/tests/runtests.c.", " - CVE-2026-56131", " * SECURITY UPDATE: heap-based buffer overflow", " - debian/patches/CVE-2026-56132-pre1.patch: lib: swap '(size_t)(-1)' for C99", " equivalent, 'SIZE_MAX' in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-pre2.patch: lib: use a `size_t` for group", " sizes in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`", " to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound", " scaffolding index store in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for", " scaffolding array limits in shared DTDs in expat/tests/runtests.c.", " - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary", " `scaffIndex` expansion in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of", " `new_connector` local in expat/lib/xmlparse.c.", " - CVE-2026-56132", " * SECURITY UPDATE: out-of-bounds read", " - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for", " functions *toUtf16 in expat/lib/xmltok.c.", " - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from", " mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.", " - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode", " surrogate mix-up in expat/tests/runtests.c.", " - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in", " `storeAttributeValue` more defensive in expat/lib/xmlparse.c.", " - CVE-2026-72522", " * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())", " - debian/patches/CVE-2026-66046.patch: - lib: Rename hash table `defaultAttsNames` to", " `defaultAttForName` in expat/lib/xmlparse.c. - lib: Migrate .isCdata", " lookup from a linear loop to a hash table lookup in", " expat/lib/xmlparse.c", " - CVE-2026-66046", " * SECURITY UPDATE: out-of-bounds read", " - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash", " table entries created by dtdCopy in expat/lib/xmlparse.c,", " expat/tests/runtests.c.", " - CVE-2026-76641", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks", " from parser reentry in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback", " reentry protection in expat/tests/runtests.c.", " - CVE-2026-76957", "" ], "package": "expat", "version": "2.4.7-1ubuntu0.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 22 Sep 2026 08:18:50 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libisns0", "from_version": { "source_package_name": "open-isns", "source_package_version": "0.101-0ubuntu2", "version": "0.101-0ubuntu2" }, "to_version": { "source_package_name": "open-isns", "source_package_version": "0.101-0ubuntu2.1", "version": "0.101-0ubuntu2.1" }, "cves": [ { "cve": "CVE-2026-55995", "url": "https://ubuntu.com/security/CVE-2026-55995", "cve_description": "A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.", "cve_priority": "medium", "cve_public_date": "2026-07-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-55995", "url": "https://ubuntu.com/security/CVE-2026-55995", "cve_description": "A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.", "cve_priority": "medium", "cve_public_date": "2026-07-29 14:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Fix double-free in malformed attribute error handling.", " - debian/patches/CVE-2026-55995.patch: Fix issue in error path causing", " double-free. in attrs.c.", " - CVE-2026-55995", "" ], "package": "open-isns", "version": "0.101-0ubuntu2.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Tue, 22 Sep 2026 13:19:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssl3", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.29", "version": "3.0.2-0ubuntu1.29" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.30", "version": "3.0.2-0ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Excessive Memory Allocation in Relative CRLDP Processing", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "NULL Pointer Dereference in CMP Client Revocation Response Handling", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Timing Side-Channel in SM2 Signature Generation", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "DTLS Retransmits Handshake Messages From a Stale Buffer Offset", "cve_priority": "high", "cve_public_date": "2026-09-29" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Excessive Memory Allocation in Relative CRLDP Processing", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "NULL Pointer Dereference in CMP Client Revocation Response Handling", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Timing Side-Channel in SM2 Signature Generation", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "DTLS Retransmits Handshake Messages From a Stale Buffer Offset", "cve_priority": "high", "cve_public_date": "2026-09-29" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Allocation in Relative CRLDP Processing", " - debian/patches/CVE-2026-35189.patch: Defer computation of relative CRLDP", " names in crypto/x509/v3_crld.c, crypto/x509/v3_purp.c,", " crypto/x509/x509_vfy.c, include/crypto/x509.h.", " - CVE-2026-35189", " * SECURITY UPDATE: Timing Side-Channel in Scalar Multiplication for Non-NIST", " EC Curves", " - debian/patches/CVE-2026-54872-pre1.patch: add value_barrier_bn() to", " include/internal/constant_time.h.", " - debian/patches/CVE-2026-54872.patch: ec: make ossl_ec_scalar_mul_ladder()", " scalar padding constant time in crypto/bn/bn_intern.c,", " crypto/ec/ec_mult.c, include/crypto/bn.h.", " - CVE-2026-54872", " * SECURITY UPDATE: NULL Pointer Dereference in CMP Client Revocation Response", " Handling", " - debian/patches/CVE-2026-75805-1.patch: Guard comparison when values are", " NULL in crypto/cmp/cmp_client.c.", " - debian/patches/CVE-2026-75805-2.patch: Add test for CVE-2026-75805 in", " test/cmp_client_test.c.", " - CVE-2026-75805", " * SECURITY UPDATE: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes", " DoS", " - debian/patches/CVE-2026-75806.patch: TLS: Reject undersized TLS 1.2 AEAD", " records before AEAD processing in ssl/record/record.h,", " ssl/record/ssl3_record.c, ssl/t1_enc.c, test/recordlentest.c.", " - CVE-2026-75806", " * SECURITY UPDATE: Timing Side-Channel in SM2 Signature Generation", " - debian/patches/CVE-2026-77696.patch: sm2: make sm2_sig_gen() constant time", " in crypto/ec/ec_mult.c, crypto/sm2/sm2_sign.c.", " - CVE-2026-77696", " * SECURITY UPDATE: DTLS Retransmits Handshake Messages From a Stale Buffer", " Offset", " - debian/patches/CVE-2026-84782.patch: dtls: reset init_off before", " retransmitting a message in ssl/d1_lib.c, ssl/statem/statem_dtls.c,", " test/dtlstest.c.", " - CVE-2026-84782", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 17 Sep 2026 10:36:24 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.29", "version": "3.0.2-0ubuntu1.29" }, "to_version": { "source_package_name": "openssl", "source_package_version": "3.0.2-0ubuntu1.30", "version": "3.0.2-0ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Excessive Memory Allocation in Relative CRLDP Processing", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "NULL Pointer Dereference in CMP Client Revocation Response Handling", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Timing Side-Channel in SM2 Signature Generation", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "DTLS Retransmits Handshake Messages From a Stale Buffer Offset", "cve_priority": "high", "cve_public_date": "2026-09-29" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Excessive Memory Allocation in Relative CRLDP Processing", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "NULL Pointer Dereference in CMP Client Revocation Response Handling", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Timing Side-Channel in SM2 Signature Generation", "cve_priority": "low", "cve_public_date": "2026-09-29" }, { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "DTLS Retransmits Handshake Messages From a Stale Buffer Offset", "cve_priority": "high", "cve_public_date": "2026-09-29" } ], "log": [ "", " * SECURITY UPDATE: Excessive Memory Allocation in Relative CRLDP Processing", " - debian/patches/CVE-2026-35189.patch: Defer computation of relative CRLDP", " names in crypto/x509/v3_crld.c, crypto/x509/v3_purp.c,", " crypto/x509/x509_vfy.c, include/crypto/x509.h.", " - CVE-2026-35189", " * SECURITY UPDATE: Timing Side-Channel in Scalar Multiplication for Non-NIST", " EC Curves", " - debian/patches/CVE-2026-54872-pre1.patch: add value_barrier_bn() to", " include/internal/constant_time.h.", " - debian/patches/CVE-2026-54872.patch: ec: make ossl_ec_scalar_mul_ladder()", " scalar padding constant time in crypto/bn/bn_intern.c,", " crypto/ec/ec_mult.c, include/crypto/bn.h.", " - CVE-2026-54872", " * SECURITY UPDATE: NULL Pointer Dereference in CMP Client Revocation Response", " Handling", " - debian/patches/CVE-2026-75805-1.patch: Guard comparison when values are", " NULL in crypto/cmp/cmp_client.c.", " - debian/patches/CVE-2026-75805-2.patch: Add test for CVE-2026-75805 in", " test/cmp_client_test.c.", " - CVE-2026-75805", " * SECURITY UPDATE: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes", " DoS", " - debian/patches/CVE-2026-75806.patch: TLS: Reject undersized TLS 1.2 AEAD", " records before AEAD processing in ssl/record/record.h,", " ssl/record/ssl3_record.c, ssl/t1_enc.c, test/recordlentest.c.", " - CVE-2026-75806", " * SECURITY UPDATE: Timing Side-Channel in SM2 Signature Generation", " - debian/patches/CVE-2026-77696.patch: sm2: make sm2_sig_gen() constant time", " in crypto/ec/ec_mult.c, crypto/sm2/sm2_sign.c.", " - CVE-2026-77696", " * SECURITY UPDATE: DTLS Retransmits Handshake Messages From a Stale Buffer", " Offset", " - debian/patches/CVE-2026-84782.patch: dtls: reset init_off before", " retransmitting a message in ssl/d1_lib.c, ssl/statem/statem_dtls.c,", " test/dtlstest.c.", " - CVE-2026-84782", "" ], "package": "openssl", "version": "3.0.2-0ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 17 Sep 2026 10:36:24 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.3", "version": "2.3.0-1ubuntu0.3" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.4", "version": "2.3.0-1ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-48522", "url": "https://ubuntu.com/security/CVE-2026-48522", "cve_description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained \"plant a JWKS to forge tokens\" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.", "cve_priority": "medium", "cve_public_date": "2026-05-28 16:16:00 UTC" }, { "cve": "CVE-2026-48526", "url": "https://ubuntu.com/security/CVE-2026-48526", "cve_description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "cve_priority": "medium", "cve_public_date": "2026-05-28 16:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-48522", "url": "https://ubuntu.com/security/CVE-2026-48522", "cve_description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained \"plant a JWKS to forge tokens\" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.", "cve_priority": "medium", "cve_public_date": "2026-05-28 16:16:00 UTC" }, { "cve": "CVE-2026-48526", "url": "https://ubuntu.com/security/CVE-2026-48526", "cve_description": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.", "cve_priority": "medium", "cve_public_date": "2026-05-28 16:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: multiple security vulnerabilities", " - debian/patches/CVE-2026-48522-to-48526.patch: Bundle security fixes and", " hardening into 2.13.0 in jwt/algorithms.py, jwt/api_jws.py,", " jwt/jwks_client.py, tests/test_algorithms.py, tests/test_api_jws.py,", " tests/test_jwks_client.py.", " - CVE-2026-48522", " - CVE-2026-48526", "" ], "package": "pyjwt", "version": "2.3.0-1ubuntu0.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shishir Subedi ", "date": "Thu, 24 Sep 2026 11:05:48 +0545" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-requests", "from_version": { "source_package_name": "requests", "source_package_version": "2.25.1+dfsg-2ubuntu0.3", "version": "2.25.1+dfsg-2ubuntu0.3" }, "to_version": { "source_package_name": "requests", "source_package_version": "2.25.1+dfsg-2ubuntu0.4", "version": "2.25.1+dfsg-2ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-25645", "url": "https://ubuntu.com/security/CVE-2026-25645", "cve_description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.", "cve_priority": "low", "cve_public_date": "2026-03-25 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-25645", "url": "https://ubuntu.com/security/CVE-2026-25645", "cve_description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.", "cve_priority": "low", "cve_public_date": "2026-03-25 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Insecure Temporary File", " - debian/patches/CVE-2026-25645.patch: Extract to non-deterministic", " location", " - CVE-2026-25645", "" ], "package": "requests", "version": "2.25.1+dfsg-2ubuntu0.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Bruce Cable ", "date": "Wed, 23 Sep 2026 13:13:18 +1000" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20260922 to 20260929", "from_series": "jammy", "to_series": "jammy", "from_serial": "20260922", "to_serial": "20260929", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }