Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:snac2 User: [email protected] Usertags: pu
[ Reason ] snac2 before version 2.93 is affected by CVE-2026-112021, a heap-based buffer overflow that allow unauthenticated attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. The CVE is currently marked as no-DSA and, after coordinating with the DSA team, they've asked me to go the p-u route. [ Impact ] snac2 users on trixie are currently vulnerable to the security vulnerability above, which has been fixed a while ago in the upstream code. [ Tests ] Upstream unfortunately doesn't have tests, but the fix has been in production for several months now without any regressions. As explained below, this is a one-line, very targeted fix. [ Risks ] The fix is a one-line change to a JSON-parsing function. While this part of the code is important to the software functionality, the change is easy to grasp and its correctness is trivially verifiable. I would classify the risk as low. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * Backport fix for CVE-2026-112021. * gbp.conf adjustment for first trixie upload. -- Sergio GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36 Please send encrypted e-mail if possible https://sergiodj.net/
diff -Nru snac2-2.75/debian/changelog snac2-2.75/debian/changelog --- snac2-2.75/debian/changelog 2025-04-17 19:07:00.000000000 -0400 +++ snac2-2.75/debian/changelog 2026-10-31 12:09:18.000000000 -0400 @@ -1,3 +1,13 @@ +snac2 (2.75-2+deb13u1) trixie; urgency=medium + + * d/p/CVE-2026-112021.patch: Backport upstream fix for CVE-2026-112021. + This vulnerability could be exploited by an unauthenticated remote + attacker by sending JSON strings containing a \u0000 escape, but would + cause a heap-based buffer overflow. + * d/gbp.conf: Update for debian/trixie branch. + + -- Sergio Durigan Junior <[email protected]> Sat, 31 Oct 2026 12:09:18 -0400 + snac2 (2.75-2) unstable; urgency=medium * d/snac2.postinst: Fix server initialization condition. diff -Nru snac2-2.75/debian/gbp.conf snac2-2.75/debian/gbp.conf --- snac2-2.75/debian/gbp.conf 2025-04-16 21:56:26.000000000 -0400 +++ snac2-2.75/debian/gbp.conf 2026-10-31 12:07:24.000000000 -0400 @@ -1,5 +1,5 @@ [DEFAULT] -debian-branch = debian/latest +debian-branch = debian/trixie pristine-tar = True [import-ref] diff -Nru snac2-2.75/debian/patches/CVE-2026-112021.patch snac2-2.75/debian/patches/CVE-2026-112021.patch --- snac2-2.75/debian/patches/CVE-2026-112021.patch 1969-12-31 19:00:00.000000000 -0500 +++ snac2-2.75/debian/patches/CVE-2026-112021.patch 2026-10-24 18:40:35.000000000 -0400 @@ -0,0 +1,27 @@ +From: grunfink <[email protected]> +Date: Thu, 25 Jun 2026 18:36:11 +0200 +Subject: Fixed JSON parser to correctly convert u0000 to the Unicode + representation. + +Backport of upstream fix to address a heap-based buffer overflow +vulnerability that allows unauthenticated remote attackers to corrupt +heap memory by sending JSON strings containing a \u0000 escape. + +Origin: backport, https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7 +--- + xs_json.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/xs_json.h b/xs_json.h +index 8b449a9..6fb54c8 100644 +--- a/xs_json.h ++++ b/xs_json.h +@@ -275,7 +275,7 @@ static xs_val *_xs_json_load_lexer(FILE *f, js_type *t) + } + + /* replace dangerous control codes with their visual representations */ +- if (cp < ' ' && !strchr("\r\n\t", cp)) ++ if (cp == 0 || (cp < ' ' && !strchr("\r\n\t", cp))) + cp += 0x2400; + + break; diff -Nru snac2-2.75/debian/patches/series snac2-2.75/debian/patches/series --- snac2-2.75/debian/patches/series 2025-01-07 18:54:08.000000000 -0500 +++ snac2-2.75/debian/patches/series 2026-10-24 18:40:35.000000000 -0400 @@ -1 +1,2 @@ 0001-Debianize-install.patch +CVE-2026-112021.patch
signature.asc
Description: PGP signature
