Hi! El 18/10/26 a las 10:50, Vincent Bernat escribió: > On 2026-10-17 17:39, Carlos Henrique Lima Melara wrote: > > > Salvatore mentioned in #debian-lts that you may want to do the update of > > haproxy to bookworm-security, so I'm mailing you to check that. > > > > Debian bookworm is LTS [1] and updates are handled by LTS team rather > > than secteam or release team. You can prepare and upload the update as > > you do for stable-security, the only caveat is after the upload and > > build by buildds, it will be published immediately in bookworm-security. > > So, if you upload there and prefer the LTS team to handle the paperwork, > > just let us know at [email protected]. > > > > We also have a very good documentation on the lts-team page [2] to > > assist anyone wanting to make a LTS update. All DDs can upload to > > bookworm-security at security-master queue. > > Hello, > > I have uploaded 2.6.12-1+deb12u4 through Debusine: > https://debusine.debian.net/debian/developers/work-request/1474656/#work_request > > I have run the regression tests and they all pass, except a few expected > failures (OpenSSL output changed). I have included the two security issues > that will be pushed to trixie-security. They don't have CVE numbers yet. I > have also included a fix for CVE-2026-33555 that didn't made it to > bookworm-security in the past. > > haproxy (2.6.12-1+deb12u4) bookworm-security; urgency=high > > * BUG/MAJOR: mux-h2: properly handle short reads on PING frames > * BUG/MAJOR: h1-htx: report an error on a too long chunk-size line > * BUG/MAJOR: h3: check body size with content-length on empty FIN > (CVE-2026-33555) > > -- Vincent Bernat <[email protected]> Sat, 17 Oct 2026 19:17:39 +0200 > > > I let you handle the paperwork. >
Just released DLA 4842-1 for it. Thanks a lot for preparing this haproxy update. Best, -- Santiago
signature.asc
Description: PGP signature
