On Sun, Aug 16, 2026 at 01:50:42PM +0200, Chris Hofstaedtler wrote: > Hi, > > On Wed, Jul 22, 2026 at 12:18:30PM +0000, [email protected] wrote: > > Source: weechat > > > > weechat 4.9.4 was released a few days ago [1] and claims to fix 2 > > security vulnerabilites. First vulnerability is likely only exploitable > > by a malicious IRC server [2]. The other vulnerability is in the relay > > code, and has been assigned GHSA-68ff-gq39-pqjm [3] and the fix is in > > [4]. > > > > Please update weechat in debian. Thank you. > > > > [1] https://weechat.org/news/180/20260719-Version-4.9.4/ > > [2] https://github.com/weechat/weechat/pull/2340 > > [3] > > https://github.com/weechat/weechat/security/advisories/GHSA-68ff-gq39-pqjm > > [4] > > https://github.com/weechat/weechat/commit/1a89d796c9cd5d99fcaafd76de55b20540efd4cc > > Thank you for fixing this in unstable. I'd like to see at least > GHSA-68ff-gq39-pqjm be fixed in trixie too, as that is reachable > directly and is a trivial authentication bypass. Leading to takeover > of weechat sessions. > > I'm attaching a diff against the version in stable, which I've > verified to work. > > Emmanuel, Security - should this go via trixie-updates instead of > security? If so, Emmanuel, can you propose this to trixie-updates? > > Many thanks, > Chris >
Hi Chris, Thank you for the patch. I fixed many security issues on branch 4.6, specifically for Debian, including the one you pointed in relay plugin: https://github.com/weechat/weechat/commits/4.6/ But I didn't make any official release as this version is not supported any more. Emmanuel: I would recommend to use this branch with all the fixes and make a specific version for Debian, thanks! -- Sébastien Helleu web: weechat.org / flashtux.org irc: FlashCode @ irc.libera.chat
