On Oct 29, 2026 07:14, Salvatore Bonaccorso <[email protected]> wrote: > > Hi Thomas, > > On Sat, Oct 24, 2026 at 04:36:13PM +0200, Salvatore Bonaccorso wrote: > > Hi Thomas, > > > > On Sat, Oct 24, 2026 at 02:47:39PM +0200, Thomas Goirand wrote: > > > Package: release.debian.org > > > Severity: normal > > > Tags: trixie > > > X-Debbugs-Cc: [email protected] > > > Control: affects -1 + src:dnspython > > > User: [email protected] > > > Usertags: pu > > > > > > Hi, > > > > > > [ Reason ] > > > I've uploaded dnspython/2.7.0-1+deb13u1 fixing CVE-2026-114605. > > > > > > [ Impact ] > > > Possible DoS with current Trixie version. > > > > > > [ Tests ] > > > The patch adds a test, ran at package build time. > > > > > > [ Risks ] > > > Not much, patch is simple. > > > > > > [ Checklist ] > > > [x] *all* changes are documented in the d/changelog > > > [x] I reviewed all changes and I approve them > > > [x] attach debdiff against the package in (old)stable > > > [x] the issue is verified as fixed in unstable > > > > But at time of writing it is yet 2.8.0-6 in unstable and missing the > > fix. Do you have an upload pending rebasing to 2.9.0 containing the > > fix? > > Friendly ping? (The fix is yet missing in unstable). > > Regards, > Salvatore
Thanks for the ping. Uploaded to Unstable this morning. Thomas
