ECHO-02F8-DF1A-3B35 Disputed by upstream. https://nvd.nist.gov/vuln/detail/CVE-2025-45582 https://lists.gnu.org/archive/html/bug-tar/2025-08/threads.html https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html

Bulletin has no description...

ECHO-1956-F8C5-351F

Bulletin has no description...

ECHO-0529-49F7-34D9

Bulletin has no description...

ECHO-42A8-3460-9DCC

Bulletin has no description...

ECHO-38B0-90F2-01F8

Bulletin has no description...

ECHO-7021-C433-F22C

Bulletin has no description...

ECHO-593E-D2F2-F6DA

Bulletin has no description...

ECHO-CB40-96F7-51CC

Bulletin has no description...

ECHO-29B2-9C4E-7DF9

Bulletin has no description...

ECHO-C04A-8EBF-D378

Bulletin has no description...

ECHO-0153-957A-44F0

Bulletin has no description...

ECHO-09F7-E6DB-15D0

Bulletin has no description...

ECHO-F0B7-359E-4A49

Bulletin has no description...

ECHO-5E0E-5634-4E9C

Bulletin has no description...

ECHO-1445-D49A-1C4B There is no fix for the cve, and the maintainers kind of ignore it as a minor issue. It is somewhat disputed, but ideally we would fix it. https://security-tracker.debian.org/tracker/CVE-2024-56433 https://github.com/shadow-maint/shadow/issues/1157

Bulletin has no description...

ECHO-BF4B-FB83-A5A9

Bulletin has no description...

ECHO-131F-3301-69B0

Bulletin has no description...

ECHO-E3B7-5995-8269 third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner. https://nvd.nist.gov/vuln/detail/CVE-2020-13092

Bulletin has no description...

ECHO-06E5-62CC-395F This issue has been fixed to the best ability of the maintainers by adjusting host key ordering to always use the default if the client has learned a hostkey matching the best-preference algorithm. Fixes beyond this are considered to reduce overall security by the maintainers. https://security-tracker.debian.org/tracker/CVE-2020-14145 https://docs.ssh-mitm.at/vulnerabilities/CVE-2020-14145.html

Bulletin has no description...

ECHO-BDD2-C207-BEF2 The CVE is disputed by upstream. It's part of 3 similar cve's, which are disputed by this article: https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf The guy who wrote the article also provides patches, 2 of them are in upstream, 3rd one only on his site. One of the patches does not completely solve it's cve (CVE-2023-31438). We should consider this not applicable in the meantime and come back to it later. https://security-tracker.debian.org/tracker/CVE-2023-31439 https://nvd.nist.gov/vuln/detail/CVE-2023-31439 https://github.com/systemd/systemd/pull/28885

Bulletin has no description...