Your message dated Wed, 30 Sep 2026 11:19:18 +0000
with message-id <[email protected]>
and subject line Bug#1148817: fixed in python-icalendar 7.3.0-1
has caused the Debian Bug report #1148817,
regarding python-icalendar: CVE-2026-77399
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148817: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148817
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-icalendar
Version: 6.3.1-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for python-icalendar.
CVE-2026-77399[0]:
| icalendar is an RFC 5545 compatible parser and generator of
| iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.from_ical
| accepts an attacker-controlled VALARM REPEAT value and applications
| that request alarm times can eagerly expand it without an
| application-level limit. Alarms.times and Alarms.active reach the
| unbounded expansion in versions starting with 6.1.0, while
| Alarm.triggers adds a second affected path starting with 7.0.0.
| Parsing alone does not trigger the issue, but accessing these
| properties can consume excessive CPU time and heap memory and
| terminate or stall a service. This issue is fixed in version 7.2.2.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-77399
https://www.cve.org/CVERecord?id=CVE-2026-77399
[1]
https://github.com/collective/icalendar/security/advisories/GHSA-qjcq-q7h7-r74v
[2]
https://github.com/collective/icalendar/commit/157f85137c65565a308bbcf4fdcc7d8ebce01267
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-icalendar
Source-Version: 7.3.0-1
Done: Alexandre Detiste <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-icalendar, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Alexandre Detiste <[email protected]> (supplier of updated python-icalendar
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 30 Sep 2026 12:38:55 +0200
Source: python-icalendar
Architecture: source
Version: 7.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Alexandre Detiste <[email protected]>
Closes: 1145541 1148817
Changes:
python-icalendar (7.3.0-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 7.3.0 (Closes: #1145541)
* CVE-2026-77399 DOS prevention (Closes: #1148817)
* Salsa CI: test nocheck & nodoc profiles
* Add build-dep on python3-sphinx-{design,issues,notfound-page,reredirects}
* Refresh patches
* Disable two unpackaged sphinx extenstions
Checksums-Sha1:
f02635a97888b5be41a4bb47bc917beeff2dff98 2844 python-icalendar_7.3.0-1.dsc
04e225334331af97e59de222113f29dc84735872 591419
python-icalendar_7.3.0.orig.tar.gz
fa492f78c1e71eb8058e679f76c5354f7dee1982 9116
python-icalendar_7.3.0-1.debian.tar.xz
a5f5763be4214cbff1459561cdc10241ee6d4a76 6707
python-icalendar_7.3.0-1_source.buildinfo
Checksums-Sha256:
ca7b0d30995492eb4bf7b593358ab1f169c13ea7b2aa959a9f2ab90a0f8567c8 2844
python-icalendar_7.3.0-1.dsc
635969a9df706befb735197b4c6c9979c856347424c625c44ae87a88a6edf3c8 591419
python-icalendar_7.3.0.orig.tar.gz
c5cb49003bbd8e0338f40994669953245709b463791428d158bc622f12d966a5 9116
python-icalendar_7.3.0-1.debian.tar.xz
b20b24c7d5affa2bec33ebf98ed3d90c829050cd085a89304a091ab50ebf9b9e 6707
python-icalendar_7.3.0-1_source.buildinfo
Files:
73616c22e8a07c450e12bea54bbb88c5 2844 python optional
python-icalendar_7.3.0-1.dsc
b73ce41c213a44edd384a29a860367d4 591419 python optional
python-icalendar_7.3.0.orig.tar.gz
d100346ea9a3e5e0e6abece0e5373d87 9116 python optional
python-icalendar_7.3.0-1.debian.tar.xz
93bfefa86d0b35d80b23f407954dc9a1 6707 python optional
python-icalendar_7.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmq87XMRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBoPBw/+LeBhgYwiWQjNFS2UV/UTGvXe5TyIDSZr
zq/o9Yvii9fkeenyzq9ULi9OTngHkSWj0yxz619U4YFaRO0WKLWbzsoFxjyyu+Rz
b+s7YKJyuwAn/C7Zc1zi8t+3E3uSHHFRlDIwxcCTbX729gFmZYN8gPAHzaJmKXvn
D4rscDDjKK4fjiXla1ZDUrIV4eZOMX19m6E4mna+lc3EEDHbK1NfFXYmcr1Qa9kv
bzhYkF9cE1DTekpb0LeX1lzzZo7QEd2Djfc2ZfwblgCYOSzPTa/ozH5KmDmjO13+
ST99qOdJhbHYTXRn32d3+XyswpoOLYKi0vA1HSxV6Dk7mMjPrLJZ3tc5q4rFzf/x
5VspHO2TIHf0Dc9JHT13CSaFQHiM+bRrLypvkE83W55yd/SujalBWkJYmmSLq4/Y
Q9ySxP2nE+zWVvAxyEdfVMOrFgxlhVV6SzWuYBxDO46M7CciO64WGrajC/88xeqO
V/UKE5h6bVOfOJXRnGHAPUSOHzhwlfexjJs7pjigqcP0TW/qPye8m/5qDmpUW5XY
RWIS6ybkMh4atJ90MQzV5aiB89mIFwKZ5ktE6xBoMJfmrmtaH9VrEea2hAiUpFRf
cNaN3yTIHsFwMLOQrTZ+rPJiqf2R5rP+gpob/TsQaC+K6AdWAjgxh1w4JVwhtCpi
UhZY+ec3UDs=
=gajg
-----END PGP SIGNATURE-----
pgp97kDrQ67B9.pgp
Description: PGP signature
--- End Message ---
