NIXPKGS-2026-1472

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-45190

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored maintainer @stigtsp 1 month, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

• https://github.com/stigtsp/Net-CIDR-Lite/commit/ca9542adec87110556601d7ce48381e… patch
• https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.24/changes release-notes
• https://www.cve.org/CVERecord?id=CVE-2026-45191 related

---

Net-CIDR-Lite

• <0.24

NIXPKGS-2026-1471

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-41493

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @mweinelt Activity log

• Created suggestion 1 month, 2 weeks ago
• @mweinelt ignored
  14 packages

  • python312Packages.pyyardian
  • python313Packages.pyyardian
  • python313Packages.yardstick
  • python314Packages.pyyardian
  • python314Packages.yardstick
  • rubyPackages.yard-solargraph
  • home-assistant-component-tests.yardian
  • rubyPackages.yard-activesupport-concern
  • rubyPackages_3_3.yard-activesupport-concern
  • rubyPackages_3_4.yard-activesupport-concern
  • rubyPackages_4_0.yard-activesupport-concern
  • rubyPackages_3_3.yard-solargraph
  • rubyPackages_3_4.yard-solargraph
  • rubyPackages_4_0.yard-solargraph
  1 month, 2 weeks ago
• @mweinelt accepted 1 month, 2 weeks ago
• @mweinelt published on GitHub 1 month, 2 weeks ago

yard: Possible arbitrary path traversal and file access via yard server

• https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj x_refsource_CONFIRM
• https://github.com/lsegal/yard/releases/tag/v0.9.42 x_refsource_MISC

---

yard

• ==< 0.9.42

https://github.com/lsegal/yard/releases/tag/v0.9.42
https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj

NIXPKGS-2026-1470

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42310

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  17 packages

  • python312Packages.pillow-heif
  • python312Packages.pillow-jpls
  • python312Packages.pillowfight
  • python313Packages.pillow-heif
  • python313Packages.pillow-jpls
  • python313Packages.pillowfight
  • python314Packages.pillow-heif
  • python314Packages.pillow-jpls
  • python314Packages.pillowfight
  • python312Packages.types-pillow
  • python313Packages.types-pillow
  • python314Packages.types-pillow
  • python312Packages.pypillowfight
  • python313Packages.pypillowfight
  • python314Packages.pypillowfight
  • python312Packages.pillow-avif-plugin
  • python313Packages.pillow-avif-plugin
  1 month, 2 weeks ago
• @LeSuisse ignored maintainer @mweinelt 1 month, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Pillow: PDF Parsing Trailer Infinite Loop (DoS)

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7 x_refsource_CONFIRM
• https://github.com/python-pillow/Pillow/pull/9519 x_refsource_MISC
• https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468 x_refsource_MISC
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC

---

Pillow

• ==>= 4.2.0, < 12.2.0

NIXPKGS-2026-1469

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42308

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  17 packages

  • python313Packages.pillow-avif-plugin
  • python312Packages.pillow-avif-plugin
  • python314Packages.pypillowfight
  • python313Packages.pypillowfight
  • python312Packages.pypillowfight
  • python314Packages.types-pillow
  • python314Packages.pillowfight
  • python314Packages.pillow-jpls
  • python314Packages.pillow-heif
  • python313Packages.pillowfight
  • python313Packages.pillow-jpls
  • python313Packages.types-pillow
  • python312Packages.types-pillow
  • python313Packages.pillow-heif
  • python312Packages.pillowfight
  • python312Packages.pillow-jpls
  • python312Packages.pillow-heif
  1 month, 2 weeks ago
• @LeSuisse ignored maintainer @mweinelt 1 month, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Pillow: Integer overflow when processing fonts

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j x_refsource_CONFIRM
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC

---

Pillow

• ==< 12.2.0

NIXPKGS-2026-1468

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42309

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  17 packages

  • python312Packages.pillow-heif
  • python312Packages.pillow-jpls
  • python312Packages.pillowfight
  • python313Packages.pillow-heif
  • python313Packages.pillow-jpls
  • python313Packages.pillowfight
  • python314Packages.pillow-heif
  • python314Packages.pillow-jpls
  • python314Packages.pillowfight
  • python312Packages.types-pillow
  • python313Packages.types-pillow
  • python314Packages.types-pillow
  • python312Packages.pypillowfight
  • python313Packages.pypillowfight
  • python314Packages.pypillowfight
  • python312Packages.pillow-avif-plugin
  • python313Packages.pillow-avif-plugin
  1 month, 2 weeks ago
• @LeSuisse ignored reference https://g… 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse ignored maintainer @mweinelt 1 month, 2 weeks ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Pillow: Heap buffer overflow with nested list coordinates

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC

---

Pillow

• ==>= 11.2.1, < 12.2.0

NIXPKGS-2026-1467

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42311

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  17 packages

  • python312Packages.pillow-heif
  • python312Packages.pillow-jpls
  • python312Packages.pillowfight
  • python313Packages.pillow-heif
  • python313Packages.pillow-jpls
  • python313Packages.pillowfight
  • python314Packages.pillow-heif
  • python314Packages.pillow-jpls
  • python314Packages.pillowfight
  • python312Packages.types-pillow
  • python313Packages.types-pillow
  • python314Packages.types-pillow
  • python312Packages.pypillowfight
  • python313Packages.pypillowfight
  • python314Packages.pypillowfight
  • python312Packages.pillow-avif-plugin
  • python313Packages.pillow-avif-plugin
  1 month, 2 weeks ago
• @LeSuisse ignored reference https://g… 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse ignored maintainer @mweinelt 1 month, 2 weeks ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr x_refsource_CONFIRM
• https://github.com/python-pillow/Pillow/pull/9520 x_refsource_MISC
• https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea x_refsource_MISC

Ignored references (1)

• https://github.com/python-pillow/Pillow/releases/tag/12.2.0 x_refsource_MISC

---

Pillow

• ==>= 10.3.0, < 12.2.0

NIXPKGS-2026-1466

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-45184

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled …

• https://commits.kde.org/kdenlive/94042ddd259551e4a7a5f6672329752972c84685
• https://commits.kde.org/kdenlive/c3999aacc6da54756f3df8aab03b900459562ecd

---

Kdenlive

• <26.04.1

NIXPKGS-2026-1465

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42296

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  2 references

  • https://github.com/argoproj/argo-workfl…
  • https://github.com/argoproj/argo-workfl…
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-3775-99mw-8rp4 x_refsource_CONFIRM
• https://github.com/argoproj/argo-workflows/commit/534f4ff1cbd86908e8ff76d97d553ad5a49a950d x_refsource_MISC

Ignored references (2)

• https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14 x_refsource_MISC
• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 x_refsource_MISC

---

argo-workflows

• ==>= 4.0.0, < 4.0.5
• ==< 3.7.14

NIXPKGS-2026-1464

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42575

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m x_refsource_CONFIRM
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa x_refsource_MISC
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 x_refsource_MISC

---

apko

• ==< 1.2.7

NIXPKGS-2026-1463

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42246

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  4 packages

  • perlPackages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl540Packages.NetIMAPClient
  1 month, 2 weeks ago
• @LeSuisse ignored
  6 references

  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/commit…
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

net-imap vulnerable to STARTTLS stripping via invalid response timing

• https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp x_refsource_CONFIRM
• https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da x_refsource_MISC

Ignored references (6)

• https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618 x_refsource_MISC
• https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e x_refsource_MISC
• https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.3.10 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC

---

net-imap

• ==>= 0.6.0, < 0.6.4
• ==< 0.3.10
• ==>= 0.4.0, < 0.4.24
• ==>= 0.5.0, < 0.5.14