Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2026/11/09

• CVE-2026-82436: Apache Storm Client: Deserialization of Untrusted Data from the State Store (Richard Zowalla <rzo1@...che.org>)
• CVE-2026-82440: Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Al… (Richard Zowalla <rzo1@...che.org>)
• CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcemen… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token valida… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-76185: Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-team secret disclos… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes cons… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airf… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched a… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-c… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered se… (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed (Rahul Vats <rahulvats@...che.org>)
• CVE-2026-124307: VVdeC/vvdecapp: Heap Use-After-Free in AdaptiveLoopFilter::reconstructCoeff via ALF APS Redefinition ("Alexander A. Shvedov" <sigdevel@...amai…)
• CVE-2026-124311: VVdeC/vvdecapp: NULL Pointer Dereference in InterPrediction::xPredInterBlk via Reference Wrap-Around ("Alexander A. Shvedov" <sigdevel@...amai…)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password… (Kevin Riggle <kevinr@...plexsystems.gro…)
• CPython: [CVE-2026-124249] http.cookiejar deletes cookies of other domains via expired Set-Cookie (Alan Coopersmith <alan.coopersmith@...cle.com>)
• CPython: [CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity (Alan Coopersmith <alan.coopersmith@...cle.…)
• Re: "sshole": password authentication bypass: OpenSSH + musl libc (Loganaden Velvindron <loganaden@...il.com>)
• Re: “sshole”: password authentication bypass: OpenSSH + musl libc (Vidya Murthy <vidya@...crypt.com>)
• Re: [musl] Re: "sshole": password authentication bypass: OpenSSH + musl libc (Rich Felker <dalias@...c.org>)
• CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical key… ("Gary D. Gregory" <ggregory@...che.org>)
• CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifi… ("Gary D. Gregory" <ggregory@...che.org>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
• CVE-2026-115864: Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker… (Robert Rothenberg <rrwo@...nsec.org>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change … (Sam Bull <9m199i@...bull.org>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password … (Brian May <brian@...uxpenguins.xyz>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password… (Kevin Riggle <kevinr@...plexsystems.gro…)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
• krb5-1.22.3 is released, with fixes for 21 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)

38 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.