Skip to content

Commit 7b60d2e

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Thu Aug 20 17:24:32 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent ef2ca2e commit 7b60d2e

5 files changed

Lines changed: 42 additions & 0 deletions

File tree

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-4X29-79GH-6V8Q": {
5+
"4afe3455ab7bd22d0aee1367b6fecd62ee6cbd79": "Improve GHSA-4x29-79gh-6v8q"
6+
},
47
"GHSA-WRJC-X8RR-H8H6": {
58
"b86f3e4d61187d7a50905dff08835f2c85852955": "Improve GHSA-wrjc-x8rr-h8h6",
69
"aa1baf23cc8965a716b41ac529e82841bae18db1": "Publish GHSA-wrjc-x8rr-h8h6"

‎data/fix-commits/common-dd5d765c.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
{
22
"vcs_url": "https://android.googlesource.com/kernel/common",
33
"vulnerabilities": {
4+
"CVE-2026-68445": {
5+
"a5edadbae57e2298a56cf7a4e774a027905a331f": "ptp: vmclock: prevent read-only mappings from becoming writable\n\nvmclock_miscdev_mmap() rejects writable mappings of the shared vmclock\nABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the\npage read-only and then upgrade it to writable with mprotect(), after\nwhich the guest can corrupt the host-written timekeeping data (sequence\ncounter, UTC time, TSC offset) that the vmclock ABI defines as read-only.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 does for its read-only objects and as fixed in drm/vc4\n(CVE-2026-68445) and drm/panthor (CVE-2024-53071).\n\nCc: stable@vger.kernel.org\nFixes: 205032724226 (\"ptp: Add support for the AMZNC10C 'vmclock' device\")\nSigned-off-by: Abdifatah Suruur <suruurism@gmail.com>\nLink: https://patch.msgid.link/20260813174707.14809-1-suruurism@gmail.com\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>"
6+
},
7+
"CVE-2024-53071": {
8+
"a5edadbae57e2298a56cf7a4e774a027905a331f": "ptp: vmclock: prevent read-only mappings from becoming writable\n\nvmclock_miscdev_mmap() rejects writable mappings of the shared vmclock\nABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the\npage read-only and then upgrade it to writable with mprotect(), after\nwhich the guest can corrupt the host-written timekeeping data (sequence\ncounter, UTC time, TSC offset) that the vmclock ABI defines as read-only.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 does for its read-only objects and as fixed in drm/vc4\n(CVE-2026-68445) and drm/panthor (CVE-2024-53071).\n\nCc: stable@vger.kernel.org\nFixes: 205032724226 (\"ptp: Add support for the AMZNC10C 'vmclock' device\")\nSigned-off-by: Abdifatah Suruur <suruurism@gmail.com>\nLink: https://patch.msgid.link/20260813174707.14809-1-suruurism@gmail.com\nSigned-off-by: Jakub Kicinski <kuba@kernel.org>"
9+
},
410
"CVE-2026-45945": {
511
"28c3f1b36a66af4fbbe78d367e9be5cbbdc88147": "BACKPORT: iommu/vt-d: Fix race condition during PASID entry replacement\n\nThe Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing\nan active PASID entry (e.g., during domain replacement), the current\nimplementation calculates a new entry on the stack and copies it to the\ntable using a single structure assignment.\n\n struct pasid_entry *pte, new_pte;\n\n pte = intel_pasid_get_entry(dev, pasid);\n pasid_pte_config_first_level(iommu, &new_pte, ...);\n *pte = new_pte;\n\nBecause the hardware may fetch the 512-bit PASID entry in multiple\n128-bit chunks, updating the entire entry while it is active (Present\nbit set) risks a \"torn\" read. In this scenario, the IOMMU hardware\ncould observe an inconsistent state \u2014 partially new data and partially\nold data \u2014 leading to unpredictable behavior or spurious faults.\n\nFix this by removing the unsafe \"replace\" helpers and following the\n\"clear-then-update\" flow, which ensures the Present bit is cleared and\nthe required invalidation handshake is completed before the new\nconfiguration is applied.\n\nFixes: 7543ee63e811 (\"iommu/vt-d: Add pasid replace helpers\")\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nReviewed-by: Samiullah Khawaja <skhawaja@google.com>\nReviewed-by: Kevin Tian <kevin.tian@intel.com>\nLink: https://lore.kernel.org/r/20260120061816.2132558-4-baolu.lu@linux.intel.com\nSigned-off-by: Joerg Roedel <joerg.roedel@amd.com>\nBug: 517578243,517579977\nBug: 541039453\nCVE: CVE-2026-45945\nChange-Id: If6a66bcf2ad67f59d79d6267608cd5907a32a584\n(cherry picked from commit c3b1edea3791fa91ab7032faa90355913ad9451b)\n[vineethrp: Adapted for pKVM-IA: remove the dual-mode (host + hypervisor)\n variants of the replace helpers along with their pKVM hypercall\n forwarding branches. With pKVM enabled, the generic host setup paths\n tear down an active entry through the pKVM teardown hypercall before\n issuing the setup hypercall. The hypervisor derives the old entry's DID\n and PGD from the live entry; its deferred entry clear is handled by\n intel_pasid_clear_entry_safe().]\nSigned-off-by: Vineeth Pillai <vineethrp@google.com>\n(cherry picked from commit 3be13f85015cfe863eae0838464dbf0e2c742e90)\nSigned-off-by: Hubert Mazur <hmazur@google.com>",
612
"3be13f85015cfe863eae0838464dbf0e2c742e90": "BACKPORT: iommu/vt-d: Fix race condition during PASID entry replacement\n\nThe Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing\nan active PASID entry (e.g., during domain replacement), the current\nimplementation calculates a new entry on the stack and copies it to the\ntable using a single structure assignment.\n\n struct pasid_entry *pte, new_pte;\n\n pte = intel_pasid_get_entry(dev, pasid);\n pasid_pte_config_first_level(iommu, &new_pte, ...);\n *pte = new_pte;\n\nBecause the hardware may fetch the 512-bit PASID entry in multiple\n128-bit chunks, updating the entire entry while it is active (Present\nbit set) risks a \"torn\" read. In this scenario, the IOMMU hardware\ncould observe an inconsistent state \u2014 partially new data and partially\nold data \u2014 leading to unpredictable behavior or spurious faults.\n\nFix this by removing the unsafe \"replace\" helpers and following the\n\"clear-then-update\" flow, which ensures the Present bit is cleared and\nthe required invalidation handshake is completed before the new\nconfiguration is applied.\n\nFixes: 7543ee63e811 (\"iommu/vt-d: Add pasid replace helpers\")\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nReviewed-by: Samiullah Khawaja <skhawaja@google.com>\nReviewed-by: Kevin Tian <kevin.tian@intel.com>\nLink: https://lore.kernel.org/r/20260120061816.2132558-4-baolu.lu@linux.intel.com\nSigned-off-by: Joerg Roedel <joerg.roedel@amd.com>\nBug: 517578243,517579977\nCVE: CVE-2026-45945\nChange-Id: If6a66bcf2ad67f59d79d6267608cd5907a32a584\n(cherry picked from commit c3b1edea3791fa91ab7032faa90355913ad9451b)\n[vineethrp: Adapted for pKVM-IA: remove the dual-mode (host + hypervisor)\n variants of the replace helpers along with their pKVM hypercall\n forwarding branches. With pKVM enabled, the generic host setup paths\n tear down an active entry through the pKVM teardown hypercall before\n issuing the setup hypercall. The hypervisor derives the old entry's DID\n and PGD from the live entry; its deferred entry clear is handled by\n intel_pasid_clear_entry_safe().]\nSigned-off-by: Vineeth Pillai <vineethrp@google.com>"

‎data/fix-commits/dbt-core-8207c5c1.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,30 @@
11
{
22
"vcs_url": "https://github.com/dbt-labs/dbt-core",
33
"vulnerabilities": {
4+
"CVE-2026-54284": {
5+
"d7675026bb1cd8595102ec5df4f886c4168fb3b3": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16013)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.12.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
6+
"7c83cc111cf5d3a066a7b27cef7569de9051c5f6": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16014)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.13.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
7+
"a5784247873fb3eecf84f858e5101f4640661fa2": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16012)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.11.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
8+
"defa080fb5f65f574d9b2a589eba55893d4bf958": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989)\n\n* chore(deps): require sqlparse>=0.6.0,<0.7.0 to pick up parser DoS fixes\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). No 0.5.x\nrelease carries those fixes, so raise the floor from 0.5.5 to 0.6.0 and\nwiden the ceiling from <0.6.0 to <0.7.0.\n\nCo-Authored-By: Ashish Shukla <ashish.shukla@dbtlabs.com>\n\n* Update Dependencies-20260819-114500.yaml\n\n* Update sqlparse dependency version range\n\nUpdated sqlparse dependency version range to address security vulnerabilities.\n\n* Update pyproject.toml\n\n---------\n\nCo-authored-by: Ashish Shukla <ashish.shukla@dbtlabs.com>"
9+
},
10+
"CVE-2026-59893": {
11+
"d7675026bb1cd8595102ec5df4f886c4168fb3b3": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16013)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.12.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
12+
"7c83cc111cf5d3a066a7b27cef7569de9051c5f6": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16014)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.13.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
13+
"a5784247873fb3eecf84f858e5101f4640661fa2": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16012)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.11.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
14+
"defa080fb5f65f574d9b2a589eba55893d4bf958": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989)\n\n* chore(deps): require sqlparse>=0.6.0,<0.7.0 to pick up parser DoS fixes\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). No 0.5.x\nrelease carries those fixes, so raise the floor from 0.5.5 to 0.6.0 and\nwiden the ceiling from <0.6.0 to <0.7.0.\n\nCo-Authored-By: Ashish Shukla <ashish.shukla@dbtlabs.com>\n\n* Update Dependencies-20260819-114500.yaml\n\n* Update sqlparse dependency version range\n\nUpdated sqlparse dependency version range to address security vulnerabilities.\n\n* Update pyproject.toml\n\n---------\n\nCo-authored-by: Ashish Shukla <ashish.shukla@dbtlabs.com>"
15+
},
16+
"CVE-2026-59894": {
17+
"d7675026bb1cd8595102ec5df4f886c4168fb3b3": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16013)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.12.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
18+
"7c83cc111cf5d3a066a7b27cef7569de9051c5f6": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16014)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.13.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
19+
"a5784247873fb3eecf84f858e5101f4640661fa2": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16012)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.11.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
20+
"defa080fb5f65f574d9b2a589eba55893d4bf958": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989)\n\n* chore(deps): require sqlparse>=0.6.0,<0.7.0 to pick up parser DoS fixes\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). No 0.5.x\nrelease carries those fixes, so raise the floor from 0.5.5 to 0.6.0 and\nwiden the ceiling from <0.6.0 to <0.7.0.\n\nCo-Authored-By: Ashish Shukla <ashish.shukla@dbtlabs.com>\n\n* Update Dependencies-20260819-114500.yaml\n\n* Update sqlparse dependency version range\n\nUpdated sqlparse dependency version range to address security vulnerabilities.\n\n* Update pyproject.toml\n\n---------\n\nCo-authored-by: Ashish Shukla <ashish.shukla@dbtlabs.com>"
21+
},
22+
"CVE-2026-71491": {
23+
"d7675026bb1cd8595102ec5df4f886c4168fb3b3": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16013)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.12.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
24+
"7c83cc111cf5d3a066a7b27cef7569de9051c5f6": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16014)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.13.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
25+
"a5784247873fb3eecf84f858e5101f4640661fa2": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989) (#16012)\n\nBackport of defa080fb5f65f574d9b2a589eba55893d4bf958 to 1.11.latest.\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). Widen the\nceiling from <0.6.0 to <0.7.0 so those fixes can be installed.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
26+
"defa080fb5f65f574d9b2a589eba55893d4bf958": "chore(deps): allow sqlparse 0.6.0 to pick up parser DoS fixes (#15989)\n\n* chore(deps): require sqlparse>=0.6.0,<0.7.0 to pick up parser DoS fixes\n\nsqlparse 0.6.0 is the fixed release for CVE-2026-54284, CVE-2026-59893,\nCVE-2026-59894 and CVE-2026-71491 (parser denial-of-service). No 0.5.x\nrelease carries those fixes, so raise the floor from 0.5.5 to 0.6.0 and\nwiden the ceiling from <0.6.0 to <0.7.0.\n\nCo-Authored-By: Ashish Shukla <ashish.shukla@dbtlabs.com>\n\n* Update Dependencies-20260819-114500.yaml\n\n* Update sqlparse dependency version range\n\nUpdated sqlparse dependency version range to address security vulnerabilities.\n\n* Update pyproject.toml\n\n---------\n\nCo-authored-by: Ashish Shukla <ashish.shukla@dbtlabs.com>"
27+
},
428
"CVE-2024-22195": {
529
"b2270fa38ad76d096029c59cbf9d43f22ba001a8": "[Backport 1.5.latest] Upgrade Jinja2 dependency version specification to address CVE-2024-22195 (#9670)\n\n* Upgrade Jinja2 dependency version specification to address CVE-2024-22195 (#9638)\r\n\r\nCVE-2024-22195 identified an issue in Jinja2 versions <= 3.1.2. As such\r\nwe've gone and changed our dependency requirement specification to be\r\n3.1.3 or greater (but less than 4).\r\n\r\nNote: Preivously we were using the `~=` version specifier. However due\r\nto some issues with the `~=` we've moved to using `>=` in combination\r\nwith `<`. This gives us the same range that `~=` gave us, but avoids\r\na pip resolution issue when multiple packages in an environment use `~=`\r\nfor the same dependency.",
630
"0a6d0c158e5a1956bd48e53793ca3b28faee2b34": "Upgrade Jinja2 dependency version specification to address CVE-2024-22195 (#9638) (#9655)\n\nCVE-2024-22195 identified an issue in Jinja2 versions <= 3.1.2. As such\r\nwe've gone and changed our dependency requirement specification to be\r\n3.1.3 or greater (but less than 4).\r\n\r\nNote: Preivously we were using the `~=` version specifier. However due\r\nto some issues with the `~=` we've moved to using `>=` in combination\r\nwith `<`. This gives us the same range that `~=` gave us, but avoids\r\na pip resolution issue when multiple packages in an environment use `~=`\r\nfor the same dependency.\r\n\r\n(cherry picked from commit 7ea46708327260c85460d8034ef6ab84fe3d1b78)\r\n\r\nCo-authored-by: Quigley Malcolm <QMalcolm@users.noreply.github.com>",

0 commit comments

Comments
 (0)