[CLSA-2026:1791791913] Fix CVE(s): CVE-2026-5119
Type:
security
Severity:
Important
Release date:
2026-10-12 07:58:43 UTC
Description:
* SECURITY UPDATE: secure cookies sent in cleartext to HTTP proxy in CONNECT requests - debian/patches/CVE-2026-5119.patch: don't add cookies to a CONNECT request for a tunnelled HTTPS connection in msg_starting_cb() in libsoup/soup-cookie-jar.c - CVE-2026-5119 * debian/patches/fix-tests-AuthDigestQop-none.patch: remove "AuthDigestQop none" from the /Digest/realm3 location and use a file-based accept mutex in tests/httpd.conf.in, so the test server starts with the updated apache2 (which accepts only qop=auth) and when the build runs as root
CVEs fixed:
Updated packages:
  • gir1.2-soup-2.4_2.62.1-1ubuntu0.4+tuxcare.els1_amd64.deb
    sha:0e1033b9638068c78e8f5029fd1d9b16bfff2b5f
  • libsoup-gnome2.4-1_2.62.1-1ubuntu0.4+tuxcare.els1_amd64.deb
    sha:08a547ecd639427233b803a45ab0aad0d95fd579
  • libsoup-gnome2.4-dev_2.62.1-1ubuntu0.4+tuxcare.els1_amd64.deb
    sha:c61d374c583f63cf9d5e26e5e9b938098b78b9ad
  • libsoup2.4-1_2.62.1-1ubuntu0.4+tuxcare.els1_amd64.deb
    sha:086904189037ce80d5f5aec93c2860d6dbd05f39
  • libsoup2.4-dev_2.62.1-1ubuntu0.4+tuxcare.els1_amd64.deb
    sha:ca5cf97dca284fc0ed8329c4e55ebdb88ca89389
  • libsoup2.4-doc_2.62.1-1ubuntu0.4+tuxcare.els1_all.deb
    sha:826d2e953484884018045629dc897d15afcb6487
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.