Your message dated Tue, 29 Sep 2026 15:49:21 +0000
with message-id <[email protected]>
and subject line Bug#1142718: fixed in libdancer2-perl 2.2.2-1
has caused the Debian Bug report #1142718,
regarding libdancer2-perl: CVE-2026-13577
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142718: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142718
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libdancer2-perl
Version: 2.1.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 1.1.2+dfsg-1
Hi,
The following vulnerability was published for libdancer2-perl.
CVE-2026-13577[0]:
| Dancer2 versions through 2.1.0 for Perl generate insecure session
| ids when required CSPRNG modules are unavailable.
| Dancer2::Core::Role::SessionFactory::generate_id silently falls back
| to a built-in rand-derived session id unless both
| Math::Random::ISAAC::XS and Crypt::URandom are available. The
| fallback session id is generated from a SHA-1 hash of a call to the
| built-in rand function, the absolute path of the
| Dancer2::Core::Role::SessionFactory module, an internal counter, the
| process id, the module instance memory address, and a shuffled
| string of characters (using the List::Util::shuffle function, which
| also uses the built-in rand function). These are all low-entropy
| and easily guessed sources. The built-in rand() function is seeded
| with 32-bits and considered unsuitable for security applications.
| Predictable session ids could allow an attacker to gain access to
| systems.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-13577
https://www.cve.org/CVERecord?id=CVE-2026-13577
[1] https://lists.security.metacpan.org/cve-announce/msg/41975698/
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libdancer2-perl
Source-Version: 2.2.2-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libdancer2-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libdancer2-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 29 Sep 2026 17:21:21 +0200
Source: libdancer2-perl
Architecture: source
Version: 2.2.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1142718 1148732
Changes:
libdancer2-perl (2.2.2-1) unstable; urgency=medium
.
* Import upstream version 2.2.1.
Includes fixes for CVE-2026-13577 CVE-2026-93709 CVE-2026-93710
CVE-2026-93711 CVE-2026-93712.
Closes: #1142718, #1148732
* Update Build-Depends-Indep, Depends, and Recommends.
* Refresh no-phone-home.patch (offset).
.
* Import upstream version 2.2.2.
- Fix cpantesters, Debian build issues in gen.t
* Drop deprecated or no longer needed lintian overrides.
* debian/watch: use uscan version 5.
Checksums-Sha1:
9a3571baf3e9c1e9a91e77ca3270d187b6bf117a 3927 libdancer2-perl_2.2.2-1.dsc
5cc5bae2780e87936af8f9c42066bd27f74affdc 487609
libdancer2-perl_2.2.2.orig.tar.gz
1c9b177ef60eb3ac7025d0f10a7752a7e71cc35e 10836
libdancer2-perl_2.2.2-1.debian.tar.xz
041a76c32dc19191ad5f78cae9ff8c7c053b1821 1015048
libdancer2-perl_2.2.2-1.git.tar.xz
7f5499b2e1e5efd06ea65cef703343eb963e043b 17756
libdancer2-perl_2.2.2-1_source.buildinfo
Checksums-Sha256:
db1e19a3f9885f9dd34f83bf77c847d482e78d2cf6c7adb300cb0c036c6f29c1 3927
libdancer2-perl_2.2.2-1.dsc
f167f2f786b9353676456e0c0a4f3255c2a40f7a048f94ada5aaac1d793d2ba1 487609
libdancer2-perl_2.2.2.orig.tar.gz
50cfff9ed426997bdee5f0696a94557eaf537a547b4167efdb82461eac83e4b4 10836
libdancer2-perl_2.2.2-1.debian.tar.xz
827f292914947197419ac7e991749075ff09d9224e585eff5a3eda441389e47f 1015048
libdancer2-perl_2.2.2-1.git.tar.xz
d90dffd241c582c6651c47c88b59aff4cd77e438bffb613f99a264378b972751 17756
libdancer2-perl_2.2.2-1_source.buildinfo
Files:
283996861b64beea4564ec8cbb506d4e 3927 perl optional libdancer2-perl_2.2.2-1.dsc
65c19995c43c85117935bc44a9556de5 487609 perl optional
libdancer2-perl_2.2.2.orig.tar.gz
0c1a86db43a6599fb40f8aa663dabee4 10836 perl optional
libdancer2-perl_2.2.2-1.debian.tar.xz
2024dffe160c104f91ced090d43ee84d 1015048 perl None
libdancer2-perl_2.2.2-1.git.tar.xz
f2b935ddd1b4a7873ad2b7476037a229 17756 perl optional
libdancer2-perl_2.2.2-1_source.buildinfo
Git-Tag-Info: tag=f11e1888e6cdcc38b8a48dea7434ffa8633c2b19
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq72rUACgkQYG0ITkaD
wHkonA//X+hhuNvN93DNC/XEfmZHSeeP0Mel2gJlv5xSeW8BXjG7XD1Bv33DBYcj
HSuulhhjbclnYsYFD1aErtOW41hGpt2Zc0KVRVUn9vC4aRa89p/8+29rBY7cqhml
xuZLFQAgmEB8033CS0shZ37TDa1F8iOLk+Ll7z5NzeOKmLPhIHpn1odfMc06Io8j
BC1r3874lyYI6jD2EFYeZb7ZZTiml2/3rErQflVKTUIwWH5oPfxsN0bzItlbXcff
2x4cZB6jmhnwdGiZdy1nhUKmtBZtv0Z8HAWKafnmjI39l8Ag4M0S/OStBnCnK8gS
ItFFejt1LikV9+yPniOV4HPM6VhlWiI14K8PSfFgwxmRJ2rGvFoUFFroXErMdPQF
4pBF16x2FaoJcJkFlfhu3fs64BrYFr7hVFTsMXfglHL0iKc98eGgNpI9u9WGcs5S
G81dg1MwOy9EkcljqwgIwiOqnUMPDcc38IhCFBo6lgpj2CMcvXXrqNvcv45Yn94Q
apjX70R3QqkZBsKvm4LNl4TDW25DWP8QBZKrOzhcGbt94SKn8/H+99EG+XZEszC/
gAZtYN9re+UXTbXZvJKlAck8lmmkWaaZPhf9H/SCHXfPKqSciULEdUJ33N18BGku
fIlVjqk9vy479IA04jtSUPIPnxnVf8sykH3s0+Rv12oRq8TiF5E=
=RibR
-----END PGP SIGNATURE-----
pgphjE4iFdWDZ.pgp
Description: PGP signature
--- End Message ---
