diff --git a/docs/releases/server-1.6.533.md b/docs/releases/server-1.6.533.md index 975351dc33..162e73330f 100644 --- a/docs/releases/server-1.6.533.md +++ b/docs/releases/server-1.6.533.md @@ -32,6 +32,16 @@ Server正式發行、成品讀回、8080部署、13語系×桌面／窄版×亮 本次 curl 三包由上述獨立官方 ADD 與 checksum 提供，不來自該舊 snapshot。 不新增 HIGH 豁免或 vendor-pending；仍須由正式成品安全 gate 確認修補結果。 +第二次官方掃描已讀回三包 `.8`，未解決輸出仍列 74 筆：上述 curl +18 個 CVE／54 筆（含 3 筆 HIGH）及原本 20 筆 MEDIUM，curl 的 +`FixedVersion` 欄位仍空白。正式 `.8` deb 的變更紀錄逐項列出這 18 個 +CVE 的安全補丁，並與 Ubuntu USN-8927-1、curl 上游修補 commit 交叉核對。 +本版以 OpenVEX `fixed` 記錄已套用的 Ubuntu backport；每項只對三個精確 +`.8` PURL 生效，附官方公告、補丁與已驗簽 deb SHA-256。 +gate 同步精確鎖定 69 項聲明及這 18 項修補集合，舊 `.7`、缺包、 +`not_affected` 或無證據的新 CVE 都不得通過。保留 scanner 原始判斷， +不宣稱原始掃描為零，不降低 HIGH gate，仍需正式 workflow 以原 gate 重驗。 + ## 邊界與升級 不改註冊API、帳號權限、OIDC、MFA、HAProxy、DB、網路後端或效能設定。 diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh index 0366ca7ffa..6226a9ed6b 100755 --- a/scripts/check-server-api-explorer-patch.sh +++ b/scripts/check-server-api-explorer-patch.sh @@ -2156,12 +2156,13 @@ for oidc_policy_smoke_marker in \ done jq -e ' - .["@context"] == "https://openvex.dev/ns/v0.2.0" + ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves + | .["@context"] == "https://openvex.dev/ns/v0.2.0" and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.533" - and (.statements | length) == 51 + and (.statements | length) == 69 and ([.statements[].vulnerability.name] | length == (unique | length)) and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort) - == ["CVE-2024-52005","CVE-2026-12087","CVE-2026-13221","CVE-2026-18798","CVE-2026-27171","CVE-2026-56391","CVE-2026-57432","CVE-2026-57433","CVE-2026-75803","CVE-2026-8932"] + == ["CVE-2024-52005","CVE-2026-107928","CVE-2026-107929","CVE-2026-12087","CVE-2026-13221","CVE-2026-18798","CVE-2026-27171","CVE-2026-56391","CVE-2026-57432","CVE-2026-57433","CVE-2026-75803","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-8932","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] and ([.statements[] | select(.status == "not_affected") | .vulnerability.name] | sort) == ["CVE-2024-2236","CVE-2024-56433","CVE-2025-1352","CVE-2025-1376","CVE-2025-66382","CVE-2026-13757","CVE-2026-18374","CVE-2026-18477","CVE-2026-18508","CVE-2026-27456","CVE-2026-3184","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-40228","CVE-2026-41080","CVE-2026-45186","CVE-2026-50219","CVE-2026-53910","CVE-2026-54371","CVE-2026-56131","CVE-2026-56132","CVE-2026-56392","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-56406","CVE-2026-56407","CVE-2026-56408","CVE-2026-56409","CVE-2026-56410","CVE-2026-56411","CVE-2026-56412","CVE-2026-56855","CVE-2026-57062","CVE-2026-66046","CVE-2026-72522","CVE-2026-76641","CVE-2026-76957","CVE-2026-78662","GO-2026-5932"] and ([.statements[] | select(.status == "under_investigation") | .vulnerability.name] | sort) @@ -2170,6 +2171,18 @@ jq -e ' and all(.statements[].products[]; (.["@id"] | startswith("pkg:") and (contains("*") | not))) and all(.statements[] | select(.status == "not_affected"); (.justification | type) == "string" and (.impact_statement | length) > 20) + and all(.statements[] | select(.vulnerability.name as $cve | $curl_fixed_cves | index($cve)); + .status == "fixed" + and (.vulnerability.name as $cve | .impact_statement | contains($cve)) + and ([.products[]."@id"] | sort) == ["pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04","pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04","pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04"] + and (.impact_statement | contains("https://ubuntu.com/security/notices/USN-8927-1") + and contains("8.18.0-1ubuntu2.8") + and contains("debian/patches/") + and contains("https://github.com/curl/curl/commit/") + and contains("2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc") + and contains("8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e") + and contains("7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266"))) + ' "$runtime_vex" >/dev/null vendor_pending_fixture=$(mktemp) diff --git a/scripts/test-server-curl-fixed-vex.py b/scripts/test-server-curl-fixed-vex.py new file mode 100644 index 0000000000..79b0bdca4c --- /dev/null +++ b/scripts/test-server-curl-fixed-vex.py @@ -0,0 +1,110 @@ +#!/usr/bin/env python3 +"""Exercise the production VEX jq predicate against exact curl fix mutations.""" +import copy +import json +from pathlib import Path +import re +import subprocess +import unittest + + +ROOT = Path(__file__).resolve().parents[1] +GATE = (ROOT / 'scripts/check-server-api-explorer-patch.sh').read_text(encoding='utf-8') +VEX = json.loads((ROOT / 'server/security/openvex.json').read_text(encoding='utf-8')) +CURL_CVES = { + 'CVE-2026-107928', 'CVE-2026-107929', 'CVE-2026-86409', 'CVE-2026-86410', + 'CVE-2026-86412', 'CVE-2026-86414', 'CVE-2026-87862', 'CVE-2026-87863', + 'CVE-2026-87864', 'CVE-2026-87865', 'CVE-2026-92386', 'CVE-2026-92387', + 'CVE-2026-92388', 'CVE-2026-92389', 'CVE-2026-92390', 'CVE-2026-92391', + 'CVE-2026-92392', 'CVE-2026-94266', +} +PURLS = {'pkg:deb/ubuntu/' + package + '@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04' + for package in ('curl', 'libcurl3t64-gnutls', 'libcurl4t64')} +HASHES = ( + '2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc', + '8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e', + '7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266', +) + + +class CurlFixedVexTests(unittest.TestCase): + @classmethod + def setUpClass(cls): + expressions = re.findall(r"jq -e '(\n.*?)\n' \"\$runtime_vex\" >/dev/null", GATE, re.S) + if len(expressions) != 1: + raise AssertionError('Expected the single actual production VEX predicate') + cls.expression = expressions[0] + cls.indices = [index for index, item in enumerate(VEX['statements']) + if item['vulnerability']['name'] in CURL_CVES] + + def gate_accepts(self, document): + result = subprocess.run(['jq', '-e', self.expression], input=json.dumps(document), + text=True, capture_output=True, check=False) + self.assertNotIn('jq: error:', result.stderr, result.stderr) + return result.returncode == 0 + + def test_actual_gate_accepts_only_the_eighteen_exact_official_fixes(self): + self.assertEqual(len(self.indices), 18) + self.assertEqual(len(VEX['statements']), 69) + self.assertTrue(self.gate_accepts(VEX)) + for index in self.indices: + statement = VEX['statements'][index] + self.assertEqual(statement['status'], 'fixed') + self.assertNotIn('justification', statement) + self.assertEqual({product['@id'] for product in statement['products']}, PURLS) + self.assertEqual(len(statement['products']), 3) + self.assertIn('https://ubuntu.com/security/notices/USN-8927-1', statement['impact_statement']) + self.assertIn(statement['vulnerability']['name'], statement['impact_statement']) + for digest in HASHES: + self.assertIn(digest, statement['impact_statement']) + + def test_not_affected_is_rejected_for_every_new_fixed_cve(self): + for index in self.indices: + with self.subTest(cve=VEX['statements'][index]['vulnerability']['name']): + mutated = copy.deepcopy(VEX) + mutated['statements'][index]['status'] = 'not_affected' + mutated['statements'][index]['justification'] = 'vulnerable_code_not_present' + self.assertFalse(self.gate_accepts(mutated)) + + def test_old_versions_and_missing_packages_are_rejected_for_every_fix(self): + for index in self.indices: + for package in range(3): + for mutation in ('old-version', 'missing-package'): + with self.subTest(cve=VEX['statements'][index]['vulnerability']['name'], + package=package, mutation=mutation): + mutated = copy.deepcopy(VEX) + products = mutated['statements'][index]['products'] + if mutation == 'old-version': + products[package]['@id'] = products[package]['@id'].replace('ubuntu2.8', 'ubuntu2.7') + else: + products.pop(package) + self.assertFalse(self.gate_accepts(mutated)) + + def test_unknown_cves_and_wildcard_products_are_rejected(self): + unknown = copy.deepcopy(VEX['statements'][self.indices[0]]) + unknown['vulnerability']['name'] = 'CVE-2026-99999999' + for append in (False, True): + mutated = copy.deepcopy(VEX) + if append: + mutated['statements'].append(unknown) + else: + mutated['statements'][self.indices[0]] = unknown + self.assertFalse(self.gate_accepts(mutated)) + mutated = copy.deepcopy(VEX) + mutated['statements'][self.indices[0]]['products'][0]['@id'] = 'pkg:deb/ubuntu/curl@*' + self.assertFalse(self.gate_accepts(mutated)) + + def test_untraceable_fix_statements_are_rejected(self): + evidence = (*HASHES, 'https://ubuntu.com/security/notices/USN-8927-1', + 'https://github.com/curl/curl/commit/', 'debian/patches/') + for index in self.indices: + for marker in evidence: + with self.subTest(cve=VEX['statements'][index]['vulnerability']['name'], evidence=marker): + mutated = copy.deepcopy(VEX) + statement = mutated['statements'][index] + statement['impact_statement'] = statement['impact_statement'].replace(marker, 'REMOVED') + self.assertFalse(self.gate_accepts(mutated)) + + +if __name__ == '__main__': + unittest.main(verbosity=2) diff --git a/server/security/openvex.json b/server/security/openvex.json index 93a2104fa6..d65c535614 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -2,8 +2,8 @@ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.533", "author": "PastureStack Security", - "timestamp": "2026-10-02T22:05:00Z", - "version": 53, + "timestamp": "2026-10-15T00:38:08Z", + "version": 54, "statements": [ { "vulnerability": { @@ -777,6 +777,330 @@ ], "status": "fixed", "impact_statement": "Ubuntu USN-8675-2 identifies 5.40.1-7ubuntu0.3 as the Ubuntu 26.04 fixed package revision for CVE-2026-57433. The final image installs and exact-verifies that revision for libperl5.40, perl, perl-base, and perl-modules-5.40 from the signed 2026-09-10 snapshot." + }, + { + "vulnerability": { + "name": "CVE-2026-107928" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-107928. The signed official package changelog records debian/patches/CVE-2026-107928.patch; upstream fix: https://github.com/curl/curl/commit/64fb3e7a7b116f6909660. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-107929" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-107929. The signed official package changelog records debian/patches/CVE-2026-107929.patch; upstream fix: https://github.com/curl/curl/commit/d37d79df1e01066417aff0a9e. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-86409" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-86409. The signed official package changelog records debian/patches/CVE-2026-86409.patch; upstream fix: https://github.com/curl/curl/commit/c3c70440e8d9938c0bb732595751e8. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-86410" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-86410. The signed official package changelog records debian/patches/CVE-2026-86410.patch; upstream fix: https://github.com/curl/curl/commit/6ae9befb2fb6bdfdb5fc11fdf76b. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-86412" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-86412. The signed official package changelog records debian/patches/CVE-2026-86412.patch; upstream fix: https://github.com/curl/curl/commit/6ded3e594455d6f018fab5f2f5d91. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-86414" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-86414. The signed official package changelog records debian/patches/CVE-2026-86414.patch; upstream fix: https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-87862" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-87862. The signed official package changelog records debian/patches/CVE-2026-87862.patch; upstream fix: https://github.com/curl/curl/commit/a1614c3bcf1593eb524b37792124357. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-87863" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-87863. The signed official package changelog records debian/patches/CVE-2026-87863.patch; upstream fix: https://github.com/curl/curl/commit/08d50a791b3197a3d0a4fc2f778e24. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-87864" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-87864. The signed official package changelog records debian/patches/CVE-2026-87864.patch; upstream fix: https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-87865" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-87865. The signed official package changelog records debian/patches/CVE-2026-87865.patch; upstream fix: https://github.com/curl/curl/commit/323c184b6bdf5b1988a10c0a61560. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92386" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92386. The signed official package changelog records debian/patches/CVE-2026-92386.patch; upstream fix: https://github.com/curl/curl/commit/445aa87e13f91c94bc742f5434. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92387" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92387. The signed official package changelog records debian/patches/CVE-2026-92387.patch; upstream fix: https://github.com/curl/curl/commit/753735af87f5c30cb6f60a7. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92388" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92388. The signed official package changelog records debian/patches/CVE-2026-92388-1.patch and debian/patches/CVE-2026-92388-2.patch; upstream fix: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92389" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92389. The signed official package changelog records debian/patches/CVE-2026-92389.patch; upstream fix: https://github.com/curl/curl/commit/63dd390fab905a239a97e270. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92390" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92390. The signed official package changelog records debian/patches/CVE-2026-92390.patch; upstream fix: https://github.com/curl/curl/commit/c24a69d8cd368de4e25e35. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92391" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92391. The signed official package changelog records debian/patches/CVE-2026-92391.patch; upstream fix: https://github.com/curl/curl/commit/d7546809d5bd548b69ec49fca2. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-94266" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-94266. The signed official package changelog records debian/patches/CVE-2026-94266.patch; upstream fix: https://github.com/curl/curl/commit/7a6bd027d0de2b6857472d35d. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." + }, + { + "vulnerability": { + "name": "CVE-2026-92392" + }, + "products": [ + { + "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + }, + { + "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04" + } + ], + "status": "fixed", + "impact_statement": "Ubuntu https://ubuntu.com/security/notices/USN-8927-1 identifies 8.18.0-1ubuntu2.8 as fixed for CVE-2026-92392. The signed official package changelog records debian/patches/CVE-2026-92392.patch; upstream fix: https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c. Verified official deb SHA-256: curl=2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc; libcurl3t64-gnutls=8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e; libcurl4t64=7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266. The image recipe pins these exact deb bytes and checks installed package versions. This records the applied Ubuntu backport while the scan feed omits FixedVersion; it is not a severity exception." } ] }