Control: tags -1 + moreinfo Hi Arif,
On Wed, Oct 14, 2026 at 05:36:44PM +0100, Arif Ali wrote: > Package: release.debian.org > Severity: normal > User: [email protected] > Usertags: pu > Tags: trixie > > This fixes a path traversal security vulnerability (CVE-2026-79655) which > was marked as <no-dsa>. > > If not fixed, then users using sos clean on untrusted archives could suffer > an arbitrary file overwrite/path traversal attack. > > Bug #1145981 and the CVE ID CVE-2026-79655 > > This is low risk, as the patches are direct backports of the upstream fix, > isolated strictly to the tar extraction verification logic inside the clean > component > > Debdiff below > > [ Reason ] > sos has a CVE, CVE-2026-79655, which is a low risk for trixie, and has > been uploaded to sid, forky, and trixie-backports > > [ Impact ] > The users using sos clean on untrusted archives could suffer an > arbitrary file overwrite/path traversal attack. > > [ Tests ] > Ran the reproducer as defined in the upstream bug [1], shown below. > The package was built on salsa, and installed on a trixie development > machine. > > root@trixie-dev:~# python3 ./reproducer.py > [cleaner] skipping tar member 'sosreport-test/var/log/escape': > 'sosreport-test/var/log/escape' is a link to an absolute path > OK: file did not escape the extraction directory > > [ Risks ] > sos may not collect the corresponding files for evaluation overall > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in stable > [x] the issue is verified as fixed in unstable Debdiff seems missing from this email, can you provide it and then remove please the moreinfo tag? Regards, Salvatore
