{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "curl", "libcurl4", "libnss-systemd", "libopeniscsiusr", "libpam-systemd", "libpng16-16", "libsystemd0", "libudev1", "open-iscsi", "openssh-client", "openssh-server", "openssh-sftp-server", "python3-jwt", "python3-urllib3", "systemd", "systemd-sysv", "systemd-timesyncd", "tzdata", "udev" ] } }, "diff": { "deb": [ { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.30", "version": "7.81.0-1ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/http_proxy.c.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c.", " - CVE-2026-87862", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " is enabled, as it makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-94266", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Mon, 12 Oct 2026 18:12:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.30", "version": "7.81.0-1ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/http_proxy.c.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c.", " - CVE-2026-87862", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " is enabled, as it makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-94266", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Mon, 12 Oct 2026 18:12:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnss-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libopeniscsiusr", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.1", "version": "2.1.5-1ubuntu1.1" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.3", "version": "2.1.5-1ubuntu1.3" }, "cves": [], "launchpad_bugs_fixed": [ 2147499 ], "changes": [ { "cves": [], "log": [ "", " * d/extra/initramfs/local-top/iscsi: normalize static bootproto for", " initramfs netplan conversion. In iscsi_auto flow, firmware reports", " bootproto as STATIC, but netinfo_to_netplan handles static IPv4", " through PROTO=none with address fields. Map STATIC to PROTO=none", " and record IPV4PROTO=static in net-*.conf. (LP: #2147499)", "" ], "package": "open-iscsi", "version": "2.1.5-1ubuntu1.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2147499 ], "author": "Zhang Hua ", "date": "Fri, 03 Jul 2026 17:04:18 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpng16-16", "from_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.6", "version": "1.6.37-3ubuntu0.6" }, "to_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.7", "version": "1.6.37-3ubuntu0.7" }, "cves": [ { "cve": "CVE-2026-46675", "url": "https://ubuntu.com/security/CVE-2026-46675", "cve_description": "[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]", "cve_priority": "medium", "cve_public_date": "2026-09-29" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-46675", "url": "https://ubuntu.com/security/CVE-2026-46675", "cve_description": "[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]", "cve_priority": "medium", "cve_public_date": "2026-09-29" } ], "log": [ "", " * SECURITY UPDATE: Use-after-free in png_read_end", " - debian/patches/CVE-2026-46675.patch: Clear stale zstream pointers when", " releasing the inflate stream in pngrutil.c", " - CVE-2026-46675", "" ], "package": "libpng1.6", "version": "1.6.37-3ubuntu0.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 05 Oct 2026 15:37:39 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "open-iscsi", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.1", "version": "2.1.5-1ubuntu1.1" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.3", "version": "2.1.5-1ubuntu1.3" }, "cves": [], "launchpad_bugs_fixed": [ 2147499 ], "changes": [ { "cves": [], "log": [ "", " * d/extra/initramfs/local-top/iscsi: normalize static bootproto for", " initramfs netplan conversion. In iscsi_auto flow, firmware reports", " bootproto as STATIC, but netinfo_to_netplan handles static IPv4", " through PROTO=none with address fields. Map STATIC to PROTO=none", " and record IPV4PROTO=static in net-*.conf. (LP: #2147499)", "" ], "package": "open-iscsi", "version": "2.1.5-1ubuntu1.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2147499 ], "author": "Zhang Hua ", "date": "Fri, 03 Jul 2026 17:04:18 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.4", "version": "2.3.0-1ubuntu0.4" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.5", "version": "2.3.0-1ubuntu0.5" }, "cves": [ { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unvalidated HTTP redirect traversal in PyJWKClient", " - debian/patches/CVE-2026-102267.patch: Reject redirects in PyJWKClient", " fetches in jwt/jwks_client.py, tests/test_jwks_client.py,", " jwt/exceptions.py, jwt/__init__.py.", " - CVE-2026-102267", " * SECURITY UPDATE: Algorithm confusion via whitespace and line-break evasion", " in is_pem_format", " - debian/patches/CVE-2026-102268.patch: fix: reject loader-accepted PEM", " variants in jwt/utils.py, tests/test_algorithms.py.", " - CVE-2026-102268", " * SECURITY UPDATE: Algorithm confusion via DER-encoded public key bytes in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102271.patch: fix: reject DER public keys as ", " HMAC secrets in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102271", " * SECURITY UPDATE: Key inspection bypass via UTF-8 Byte Order Mark (BOM) in", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102272.patch: Reject encoded JWKs as HMAC keys", " in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102272", " * SECURITY UPDATE: Key-type spoofing via nested JWK container structures in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102273.patch: fix: reject public JWK container", " HMAC keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102273", "" ], "package": "pyjwt", "version": "2.3.0-1ubuntu0.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Mon, 12 Oct 2026 11:05:30 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-urllib3", "from_version": { "source_package_name": "python-urllib3", "source_package_version": "1.26.5-1~exp1ubuntu0.7", "version": "1.26.5-1~exp1ubuntu0.7" }, "to_version": { "source_package_name": "python-urllib3", "source_package_version": "1.26.5-1~exp1ubuntu0.8", "version": "1.26.5-1~exp1ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of Service", " - debian/patches/CVE-2026-97689.patch: Bound chunk-size line reads", " to prevent memory exhaustion DoS", " - CVE-2026-97689", "" ], "package": "python-urllib3", "version": "1.26.5-1~exp1ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Bruce Cable ", "date": "Tue, 13 Oct 2026 14:01:23 +1100" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-timesyncd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026c-0ubuntu0.22.04.1", "version": "2026c-0ubuntu0.22.04.1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026e-0ubuntu0.22.04.1", "version": "2026e-0ubuntu0.22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2169125 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (LP: #2169125):", " - Canada’s Northwest Territories moved to permanent -06 on 2026-08-21 and", " will not fall back from -06 to -07 on 2026-11-01", " - Manitoba moves to permanent -05 on 2026-10-31 and will not fall back", " from -05 to -06 on 2026-11-01", " * Add autopkgtest test cases for 2026d and 2026e releases", " * Revert POSIX conformance of old SysV names EST5EDT, CST6CDT, MST7MDT and", " PST8PDT", " * Update the ICU timezone data to 2026e", " * Add autopkgtest test case for ICU timezone data 2026d and 2026e", "" ], "package": "tzdata", "version": "2026e-0ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2169125 ], "author": "Benjamin Drung ", "date": "Mon, 05 Oct 2026 11:21:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261007 to 20261014", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261007", "to_serial": "20261014", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }