{"id":"CLSA-2026-1784268522","summary":"Fix CVE(s): CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42015","details":"   * SECURITY UPDATE: name-constraints bypass with excluded-only parent CA\n     - debian/patches/CVE-2026-42011.patch: take permitted name\n       constraints into account when a prior CA in the chain carried only\n       excluded constraints, so a constrained sub-CA can no longer issue\n       certificates outside its permitted scope, in\n       lib/x509/name_constraints.c.\n     - CVE-2026-42011\n   * SECURITY UPDATE: CN fallback not precluded by URI SAN\n     - debian/patches/CVE-2026-42012.patch: treat a URI subject\n       alternative name as precluding the fallback to Common Name\n       hostname matching, per RFC 6125 6.4.4, in\n       lib/x509/hostname-verify.c.\n     - CVE-2026-42012\n   * SECURITY UPDATE: CN/DN fallback not precluded by oversized SAN\n     - debian/patches/CVE-2026-42013.patch: keep the CN (hostname) and\n       DN-email fallbacks disabled when a subject alternative name is\n       oversized instead of silently ignoring it, per RFC 6125 6.4.4, in\n       lib/x509/hostname-verify.c and lib/x509/email-verify.c.\n     - CVE-2026-42013\n   * SECURITY UPDATE: PKCS#12 bag out-of-bounds write\n     - debian/patches/CVE-2026-42015.patch: fix an off-by-one in the\n       PKCS#12 bag element bounds check that allowed writing past the\n       32-element array, in lib/x509/pkcs12_bag.c.\n     - CVE-2026-42015","modified":"2026-10-26T09:31:47.202590922Z","published":"2026-07-17T06:09:11Z","upstream":["CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42015"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784268522.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42011"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42012"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42013"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42015"}],"affected":[{"package":{"name":"gnutls-bin","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/gnutls-bin?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"gnutls-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/gnutls-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"libgnutls-dane0","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgnutls-dane0?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"libgnutls-openssl27","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgnutls-openssl27?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"libgnutls28-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgnutls28-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"libgnutls30","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgnutls30?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}},{"package":{"name":"libgnutlsxx28","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgnutlsxx28?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784268522.json"}}],"schema_version":"1.9.0"}