diff --git a/vulnerabilities/importers/__init__.py b/vulnerabilities/importers/__init__.py index a33e6d714..08e567e33 100644 --- a/vulnerabilities/importers/__init__.py +++ b/vulnerabilities/importers/__init__.py @@ -48,6 +48,7 @@ from vulnerabilities.pipelines.v2_importers import retiredotnet_importer as retiredotnet_importer_v2 from vulnerabilities.pipelines.v2_importers import ruby_importer as ruby_importer_v2 from vulnerabilities.pipelines.v2_importers import suse_score_importer as suse_score_importer_v2 +from vulnerabilities.pipelines.v2_importers import tuxcare_importer as tuxcare_importer_v2 from vulnerabilities.pipelines.v2_importers import ubuntu_osv_importer as ubuntu_osv_importer_v2 from vulnerabilities.pipelines.v2_importers import vulnrichment_importer as vulnrichment_importer_v2 from vulnerabilities.pipelines.v2_importers import xen_importer as xen_importer_v2 @@ -83,6 +84,7 @@ debian_importer_v2.DebianImporterPipeline, mattermost_importer_v2.MattermostImporterPipeline, glibc_importer_v2.GlibcImporterPipeline, + tuxcare_importer_v2.TuxCareImporterPipeline, apache_tomcat_v2.ApacheTomcatImporterPipeline, suse_score_importer_v2.SUSESeverityScoreImporterPipeline, retiredotnet_importer_v2.RetireDotnetImporterPipeline, diff --git a/vulnerabilities/pipelines/v2_importers/tuxcare_importer.py b/vulnerabilities/pipelines/v2_importers/tuxcare_importer.py new file mode 100644 index 000000000..9eff1e890 --- /dev/null +++ b/vulnerabilities/pipelines/v2_importers/tuxcare_importer.py @@ -0,0 +1,85 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/aboutcode-org/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +import json +import logging +from io import BytesIO +from typing import Iterable +from zipfile import ZipFile + +import requests + +from vulnerabilities.importer import AdvisoryDataV2 +from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2 +from vulnerabilities.pipes.osv_v2 import parse_advisory_data_v3 + + +class TuxCareImporterPipeline(VulnerableCodeBaseImporterPipelineV2): + """ + TuxCare Importer Pipeline + Collect advisories from TuxCare OSV feed. + """ + + pipeline_id = "tuxcare_importer_v2" + datasource_id = "tuxcare" + license_url = "https://tuxcare.com/legal" + spdx_license_expression = "Apache-2.0" + url = "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + precedence = 100 + + @classmethod + def steps(cls): + return ( + cls.fetch_zip, + cls.collect_and_store_advisories, + ) + + def fetch_zip(self): + self.log(f"Fetching `{self.url}`") + self.advisory_zip = requests.get(self.url).content + + def advisories_count(self) -> int: + with ZipFile(BytesIO(self.advisory_zip)) as zip_file: + advisory_count = sum( + 1 + for file in zip_file.namelist() + if file.startswith("CLSA-") and file.endswith(".json") + ) + return advisory_count + + def collect_advisories(self) -> Iterable[AdvisoryDataV2]: + """Yield AdvisoryDataV2 using a zipped data dump of OSV data""" + supported_ecosystems = [ + # els_os + "rpm", + "deb", + # els_lang + "maven", + "npm", + "pypi", + "composer", + ] + + with ZipFile(BytesIO(self.advisory_zip)) as zip_file: + for file_name in zip_file.namelist(): + if not (file_name.startswith("CLSA-") and file_name.endswith(".json")): + self.log( + f"Unsupported TuxCare advisory data file: {file_name}", + level=logging.ERROR, + ) + continue + with zip_file.open(file_name) as f: + advisory_text = f.read() + vul_info = json.loads(advisory_text) + yield parse_advisory_data_v3( + raw_data=vul_info, + supported_ecosystems=supported_ecosystems, + advisory_url=self.url, + advisory_text=advisory_text.decode("utf-8"), + ) diff --git a/vulnerabilities/tests/pipelines/v2_importers/test_tuxcare_importer_v2.py b/vulnerabilities/tests/pipelines/v2_importers/test_tuxcare_importer_v2.py new file mode 100644 index 000000000..772795f7b --- /dev/null +++ b/vulnerabilities/tests/pipelines/v2_importers/test_tuxcare_importer_v2.py @@ -0,0 +1,60 @@ +# +# Copyright (c) nexB Inc. and others. All rights reserved. +# VulnerableCode is a trademark of nexB Inc. +# SPDX-License-Identifier: Apache-2.0 +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. +# See https://github.com/aboutcode-org/vulnerablecode for support or download. +# See https://aboutcode.org for more information about nexB OSS projects. +# + +from io import BytesIO +from pathlib import Path +from unittest import TestCase +from unittest.mock import Mock +from unittest.mock import patch +from zipfile import ZipFile + +from vulnerabilities.pipelines.v2_importers.tuxcare_importer import TuxCareImporterPipeline +from vulnerabilities.tests import util_tests + +TEST_DATA = Path(__file__).parent.parent.parent / "test_data" / "tuxcare" + + +class TestTuxCareImporterPipeline(TestCase): + """Tests for TuxCareImporterPipeline using OSV feed data.""" + + @classmethod + def setUpClass(cls): + super().setUpClass() + zip_buffer = BytesIO() + with ZipFile(zip_buffer, mode="w") as zip_file: + for json_file in sorted(TEST_DATA.glob("CLSA-*.json")): + zip_file.writestr(json_file.name, json_file.read_bytes()) + cls.sample_zip = zip_buffer.getvalue() + + @patch("requests.get") + def test_fetch_zip(self, mock_get): + mock_get.return_value = Mock(content=self.sample_zip) + + pipeline = TuxCareImporterPipeline() + pipeline.fetch_zip() + + mock_get.assert_called_once_with(pipeline.url) + self.assertEqual(pipeline.advisory_zip, self.sample_zip) + + def test_advisories_count(self): + pipeline = TuxCareImporterPipeline() + pipeline.advisory_zip = self.sample_zip + + self.assertEqual(pipeline.advisories_count(), 6) + + def test_collect_advisories(self): + pipeline = TuxCareImporterPipeline() + pipeline.advisory_zip = self.sample_zip + + advisories = [data.to_dict() for data in pipeline.collect_advisories()] + advisories = sorted(advisories, key=lambda a: a["advisory_id"]) + + expected_file = TEST_DATA / "expected.json" + util_tests.check_results_against_json(advisories, expected_file) + self.assertEqual(len(advisories), 6) diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1763136711.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1763136711.json new file mode 100644 index 000000000..d41ac9232 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1763136711.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.7.5", + "id": "CLSA-2025-1763136711", + "published": "2025-11-14T16:11:55Z", + "modified": "2026-06-04T09:45:21.689571417Z", + "upstream": [ + "CVE-2022-29154", + "CVE-2024-12087", + "CVE-2024-12088" + ], + "summary": "Fix CVE(s): CVE-2022-29154, CVE-2024-12087, CVE-2024-12088", + "details": " * SECURITY UPDATE: malicious remote servers to write arbitrary files inside\n the directories of connecting peers:\n - debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file\n names.\n - CVE-2022-29154.\n * SECURITY UPDATE: path traversal vulnerability.\n - debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and\n range check dir_ndx before use\n - CVE-2024-12087\n * SECURITY UPDATE: rsync client fails to properly verify if a symbolic link\n destination sent from the server contains another symbolic link within it:\n - debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter.\n - CVE-2024-12088.", + "affected": [ + { + "package": { + "name": "rsync", + "ecosystem": "TuxCare:Debian:10", + "purl": "pkg:deb/tuxcare/rsync?distro=debian-10" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.3-6+tuxcare.els1" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2025-1763136711.json" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763136711.html" + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1765930349.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1765930349.json new file mode 100644 index 000000000..60e9f1103 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2025-1765930349.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.9.0", + "id": "CLSA-2025-1765930349", + "published": "2026-08-04T14:52:09Z", + "modified": "2026-10-15T09:47:53.555363298Z", + "upstream": [ + "AIKIDO-2024-10370" + ], + "summary": "TuxCare security update for sentence-transformers (1 CVE)", + "details": "TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare.", + "affected": [ + { + "package": { + "name": "sentence-transformers", + "ecosystem": "TuxCare:PyPI", + "purl": "pkg:pypi/sentence-transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.7.0.post1+tuxcare" + } + ] + } + ], + "versions": [ + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_lang/pypi/CLSA-2025-1765930349.json", + "tuxcare": { + "base_version": "2.7.0", + "fixed_version": "2.7.0.post1+tuxcare" + } + } + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1776213254.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1776213254.json new file mode 100644 index 000000000..288ab9aa7 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1776213254.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.9.0", + "id": "CLSA-2026-1776213254", + "published": "2026-08-04T14:52:25Z", + "modified": "2026-10-15T09:47:59.566920710Z", + "upstream": [ + "CVE-2021-21263", + "CVE-2021-43808", + "CVE-2024-52301", + "CVE-2025-27515", + "GHSA-4mg9-vhxq-vm7j", + "GHSA-jwvj-pwww-3mj5", + "GHSA-wq8p-mqvg-2p5h", + "GHSA-x7p5-p2c9-phvg" + ], + "summary": "TuxCare security update for laravel/framework (8 CVEs)", + "details": "TuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 8.12.2-p1+tuxcare.", + "affected": [ + { + "package": { + "name": "laravel/framework", + "ecosystem": "TuxCare:Packagist", + "purl": "pkg:composer/laravel/framework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.12.2" + }, + { + "fixed": "8.12.2-p1+tuxcare" + } + ] + } + ], + "versions": [ + "8.12.2" + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_lang/packagist/CLSA-2026-1776213254.json", + "tuxcare": { + "base_version": "8.12.2", + "fixed_version": "8.12.2-p1+tuxcare" + } + } + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1777660524.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1777660524.json new file mode 100644 index 000000000..2d077d703 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1777660524.json @@ -0,0 +1,180 @@ +{ + "schema_version": "1.7.5", + "id": "CLSA-2026-1777660524", + "published": "2026-05-01T18:35:28Z", + "modified": "2026-06-01T00:32:28.749059063Z", + "upstream": [ + "CVE-2026-6100" + ], + "summary": "python3.11: Fix of CVE-2026-6100", + "details": "- CVE-2026-6100 fix use-after-free in lzma/bz2 decompressor by clearing\n the dangling next_in pointer after MemoryError so a re-used\n decompressor cannot read or write through a stale buffer pointer", + "affected": [ + { + "package": { + "name": "python3.11", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-debug", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-debug?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-devel", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-devel?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-idle", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-idle?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-libs", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-libs?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-test", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-test?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + }, + { + "package": { + "name": "python3.11-tkinter", + "ecosystem": "TuxCare:AlmaLinux:9.2", + "purl": "pkg:rpm/tuxcare/python3.11-tkinter?distro=almalinux-9.2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.11.2-2.el9_2.2.tuxcare.els21" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777660524.json" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777660524.html" + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792379983.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792379983.json new file mode 100644 index 000000000..2479bf12e --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792379983.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.9.0", + "id": "CLSA-2026-1792379983", + "published": "2026-10-19T03:19:39Z", + "modified": "2026-10-19T07:47:12.647649890Z", + "upstream": [ + "CVE-2026-54264", + "CVE-2026-54265", + "CVE-2026-54266", + "CVE-2026-54267", + "CVE-2026-54268" + ], + "summary": "TuxCare security update for @angular/platform-server (5 CVEs)", + "details": "TuxCare rebuilt @angular/platform-server to address 5 CVEs. Fixed in 18.2.14-tuxcare.12.", + "affected": [ + { + "package": { + "name": "@angular/platform-server", + "ecosystem": "TuxCare:npm", + "purl": "pkg:npm/%40angular/platform-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "18.2.14-tuxcare.0" + }, + { + "fixed": "18.2.14-tuxcare.12" + } + ] + } + ], + "versions": [ + "18.2.14", + "18.2.14-tuxcare.1", + "18.2.14-tuxcare.10", + "18.2.14-tuxcare.11", + "18.2.14-tuxcare.3", + "18.2.14-tuxcare.4", + "18.2.14-tuxcare.5", + "18.2.14-tuxcare.6", + "18.2.14-tuxcare.7", + "18.2.14-tuxcare.9" + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_lang/npm/CLSA-2026-1792379983.json", + "tuxcare": { + "base_version": "18.2.14", + "fixed_version": "18.2.14-tuxcare.12" + } + } + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792431625.json b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792431625.json new file mode 100644 index 000000000..3dd0b4a04 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/CLSA-2026-1792431625.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.9.0", + "id": "CLSA-2026-1792431625", + "published": "2026-10-19T17:40:25Z", + "modified": "2026-10-19T19:15:04.738759293Z", + "upstream": [ + "CVE-2026-89425" + ], + "summary": "TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)", + "details": "TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.1-tuxcare.2.", + "affected": [ + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-core", + "ecosystem": "TuxCare:Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.12.1" + }, + { + "fixed": "2.12.1-tuxcare.2" + } + ] + } + ], + "versions": [ + "2.12.1", + "2.12.1-tuxcare.1" + ], + "database_specific": { + "source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_lang/maven/CLSA-2026-1792431625.json", + "tuxcare": { + "base_version": "2.12.1", + "fixed_version": "2.12.1-tuxcare.2" + } + } + } + ] +} \ No newline at end of file diff --git a/vulnerabilities/tests/test_data/tuxcare/expected.json b/vulnerabilities/tests/test_data/tuxcare/expected.json new file mode 100644 index 000000000..232486ed8 --- /dev/null +++ b/vulnerabilities/tests/test_data/tuxcare/expected.json @@ -0,0 +1,285 @@ +[ + { + "advisory_id": "CLSA-2025-1763136711", + "aliases": [ + "CVE-2022-29154", + "CVE-2024-12087", + "CVE-2024-12088" + ], + "summary": "Fix CVE(s): CVE-2022-29154, CVE-2024-12087, CVE-2024-12088\n* SECURITY UPDATE: malicious remote servers to write arbitrary files inside\n the directories of connecting peers:\n - debian/patches/els/0001-CVE-2022-29154.patch: fix insufficient validation of file\n names.\n - CVE-2022-29154.\n * SECURITY UPDATE: path traversal vulnerability.\n - debian/patches/els/0002-CVE-2024-12087.patch: refuse a duplicate dirlist and\n range check dir_ndx before use\n - CVE-2024-12087\n * SECURITY UPDATE: rsync client fails to properly verify if a symbolic link\n destination sent from the server contains another symbolic link within it:\n - debian/patches/els/0003-CVE-2024-12088.patch: make --safe-links stricter.\n - CVE-2024-12088.", + "affected_packages": [ + { + "package": { + "type": "deb", + "namespace": "tuxcare", + "name": "rsync", + "version": "", + "qualifiers": "distro=debian-10", + "subpath": "" + }, + "affected_version_range": "vers:deb/<3.1.3-6+tuxcare.els1", + "fixed_version_range": "vers:deb/3.1.3-6+tuxcare.els1", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [ + { + "reference_id": "", + "reference_type": "", + "url": "https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763136711.html" + } + ], + "patches": [], + "severities": [], + "date_published": "2025-11-14T16:11:55+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + }, + { + "advisory_id": "CLSA-2025-1765930349", + "aliases": [ + "AIKIDO-2024-10370" + ], + "summary": "TuxCare security update for sentence-transformers (1 CVE)\nTuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare.", + "affected_packages": [ + { + "package": { + "type": "pypi", + "namespace": "", + "name": "sentence-transformers", + "version": "", + "qualifiers": "", + "subpath": "" + }, + "affected_version_range": "vers:pypi/2.7.0", + "fixed_version_range": "vers:pypi/2.7.0.post1+tuxcare", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [], + "patches": [], + "severities": [], + "date_published": "2026-08-04T14:52:09+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + }, + { + "advisory_id": "CLSA-2026-1776213254", + "aliases": [ + "CVE-2021-21263", + "CVE-2021-43808", + "CVE-2024-52301", + "CVE-2025-27515", + "GHSA-4mg9-vhxq-vm7j", + "GHSA-jwvj-pwww-3mj5", + "GHSA-wq8p-mqvg-2p5h", + "GHSA-x7p5-p2c9-phvg" + ], + "summary": "TuxCare security update for laravel/framework (8 CVEs)\nTuxCare rebuilt laravel/framework to address 8 CVEs. Fixed in 8.12.2-p1+tuxcare.", + "affected_packages": [ + { + "package": { + "type": "composer", + "namespace": "laravel", + "name": "framework", + "version": "", + "qualifiers": "", + "subpath": "" + }, + "affected_version_range": "vers:composer/8.12.2", + "fixed_version_range": "vers:composer/8.12.2-p1+tuxcare", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [], + "patches": [], + "severities": [], + "date_published": "2026-08-04T14:52:25+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + }, + { + "advisory_id": "CLSA-2026-1777660524", + "aliases": [ + "CVE-2026-6100" + ], + "summary": "python3.11: Fix of CVE-2026-6100\n- CVE-2026-6100 fix use-after-free in lzma/bz2 decompressor by clearing\n the dangling next_in pointer after MemoryError so a re-used\n decompressor cannot read or write through a stale buffer pointer", + "affected_packages": [ + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-debug", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-devel", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-idle", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-libs", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-test", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + }, + { + "package": { + "type": "rpm", + "namespace": "tuxcare", + "name": "python3.11-tkinter", + "version": "", + "qualifiers": "distro=almalinux-9.2", + "subpath": "" + }, + "affected_version_range": "vers:rpm/<3.11.2-2.el9_2.2.tuxcare.els21", + "fixed_version_range": "vers:rpm/3.11.2-2.el9_2.2.tuxcare.els21", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [ + { + "reference_id": "", + "reference_type": "", + "url": "https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777660524.html" + } + ], + "patches": [], + "severities": [], + "date_published": "2026-05-01T18:35:28+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + }, + { + "advisory_id": "CLSA-2026-1792379983", + "aliases": [ + "CVE-2026-54264", + "CVE-2026-54265", + "CVE-2026-54266", + "CVE-2026-54267", + "CVE-2026-54268" + ], + "summary": "TuxCare security update for @angular/platform-server (5 CVEs)\nTuxCare rebuilt @angular/platform-server to address 5 CVEs. Fixed in 18.2.14-tuxcare.12.", + "affected_packages": [ + { + "package": { + "type": "npm", + "namespace": "@angular", + "name": "platform-server", + "version": "", + "qualifiers": "", + "subpath": "" + }, + "affected_version_range": "vers:npm/18.2.14-tuxcare.1|18.2.14-tuxcare.3|18.2.14-tuxcare.4|18.2.14-tuxcare.5|18.2.14-tuxcare.6|18.2.14-tuxcare.7|18.2.14-tuxcare.9|18.2.14-tuxcare.10|18.2.14-tuxcare.11|18.2.14", + "fixed_version_range": "vers:npm/18.2.14-tuxcare.12", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [], + "patches": [], + "severities": [], + "date_published": "2026-10-19T03:19:39+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + }, + { + "advisory_id": "CLSA-2026-1792431625", + "aliases": [ + "CVE-2026-89425" + ], + "summary": "TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)\nTuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.1-tuxcare.2.", + "affected_packages": [ + { + "package": { + "type": "maven", + "namespace": "com.fasterxml.jackson.core", + "name": "jackson-core", + "version": "", + "qualifiers": "", + "subpath": "" + }, + "affected_version_range": "vers:maven/2.12.1|2.12.1-tuxcare.1", + "fixed_version_range": "vers:maven/2.12.1-tuxcare.2", + "introduced_by_commit_patches": [], + "fixed_by_commit_patches": [] + } + ], + "references": [], + "patches": [], + "severities": [], + "date_published": "2026-10-19T17:40:25+00:00", + "weaknesses": [], + "url": "https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip" + } +]