[CLSA-2026:1794267885] Fix CVE(s): CVE-2026-45793, CVE-2026-59947

Type:

security

Severity:

Important

Release date:

2026-11-09 23:44:57 UTC

Description:

   * Non-maintainer upload by the TuxCare ELS team.
   * CVE-2026-45793: Stop rejecting GitHub OAuth tokens that contain "-"
     (such as GitHub Actions ghs_ installation tokens), which disclosed the
     token in the error message, and mask such tokens in debug command
     output.
     - debian/patches/0022-CVE-2026-45793.patch
   * CVE-2026-59947: Mask tokens passed in the username part of a URL
     (https://TOKEN@host/) in -vvv debug command output.
     - debian/patches/0023-CVE-2026-59947.patch

CVEs fixed:

CVE-2026-45793
CVE-2026-59947

Updated packages:

composer_1.8.4-1+deb10u4+tuxcare.els3_all.deb
sha:0b4565f8ca099e1c6ecace9ca42e326b2c2837ba

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.