Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:kakoune User: [email protected] Usertags: pu
This is a future unblock request for a no-DSA security fix to the kakoune source package. [ Reason ] As discussed in #1143968, there is a security issue that is not triggered by a default setup, but it may still affect Debian users of kakoune who have activated the autorestore functionality. [ Impact ] A security fix will not be present in the trixie version of kakoune. [ Tests ] The upstream commit that has been added as the CVE-2026-48120 patch indeed involves an addition to the build- and autopkgtest-time test suite that makes sure the fix works. [ Risks ] The change in the shell part of the kakoune autorestore tool is relatively simple. It is limited in scope to only validating and sanitizing filenames. As such, I believe the risk to be minimal. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Add the CVE-2026-48120 patch that makes the autorestore tool validate the filenames it finds in the recorded files. [ Other info ] The issue is fixed in unstable by the just-uploaded 2026.05.21 new upstream release.
diff -Nru kakoune-2024.05.18/debian/changelog kakoune-2024.05.18/debian/changelog --- kakoune-2024.05.18/debian/changelog 2024-09-03 16:47:12.000000000 +0300 +++ kakoune-2024.05.18/debian/changelog 2026-08-09 20:27:34.000000000 +0300 @@ -1,3 +1,9 @@ +kakoune (2024.05.18-2+deb13u1) trixie; urgency=medium + + * Add the CVE-2026-48120 patch; Closes: #1143968 + + -- Peter Pentchev <[email protected]> Sun, 09 Aug 2026 20:27:34 +0300 + kakoune (2024.05.18-2) unstable; urgency=medium * Fix FTBFS with debhelper 13.17 and later: we override dh_auto_install, diff -Nru kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch --- kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch 1970-01-01 02:00:00.000000000 +0200 +++ kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch 2026-08-09 20:21:20.000000000 +0300 @@ -0,0 +1,82 @@ +Description: Fix escaping issues in autorestore.kak + Ensure filenames are escaped when echo'ed, and validate that we only + have posix portable characters (i.e. [A-Za-z0-9_.-]) as part of the + suffix, as mkstemp is specified to behave. +Bug-Debian: https://bugs.debian.org/1143968 +Origin: upstream, https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825 +Author: Maxime Coste <[email protected]> +Last-Update: 2026-08-09 + +--- a/rc/tools/autorestore.kak ++++ b/rc/tools/autorestore.kak +@@ -16,25 +16,30 @@ + evaluate-commands %sh{ + buffer_basename="${kak_buffile##*/}" + buffer_dirname=$(dirname "${kak_buffile}") ++ backup_prefix="${buffer_dirname}"/".${buffer_basename}.kak." + + if [ -f "${kak_buffile}" ]; then +- newer=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1) +- older=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1) ++ newer=$(find "${backup_prefix}"* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1) ++ older=$(find "${backup_prefix}"* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1) + else + # New buffers that were never written to disk. +- newer=$(ls -1t "${buffer_dirname}"/".${buffer_basename}.kak."* 2>/dev/null | head -n 1) ++ newer=$(ls -1t "${backup_prefix}"* 2>/dev/null | head -n 1) + older="" + fi + + if [ -z "${newer}" ]; then + if [ -n "${older}" ]; then +- printf %s\\n " +- echo -debug Old backup file(s) found: will not restore ${older} . +- " ++ printf "echo -debug 'Old backup file(s) found: will not restore %s.'" "$(printf %s "${older}" | sed s/\'/\'\'/g)" + fi + exit + fi + ++ # ensure backup suffix only contains portable filename characters ++ if ! pathchk -p "$(printf %s "${newer}" | cut -b ${#backup_prefix}-)" >/dev/null 2>&1; then ++ printf "echo -debug 'backup file suffix contains unexpected characters %s, ignored.'" "$(printf %s "${newer}" | sed s/\'/\'\'/g)" ++ exit ++ fi ++ + printf %s\\n " + ## Replace the content of the buffer with the content of the backup file + echo -debug Restoring file: ${newer} +--- /dev/null ++++ b/test/tools/autorestore/autorestore/env +@@ -0,0 +1,3 @@ ++BACKUP='.out.kak.AABBCC' ++echo BACKUP > "$BACKUP" ++while [ ! "$BACKUP" -nt out ]; do touch "$BACKUP"; done +--- /dev/null ++++ b/test/tools/autorestore/autorestore/out +@@ -0,0 +1 @@ ++BACKUP +--- /dev/null ++++ b/test/tools/autorestore/autorestore/rc +@@ -0,0 +1,2 @@ ++source "%val{runtime}/rc/tools/autorestore.kak" ++autorestore-restore-buffer +--- /dev/null ++++ b/test/tools/autorestore/check-portable-character-set/env +@@ -0,0 +1,3 @@ ++BACKUP='.out.kak.;"foo"' ++echo BACKUP > "$BACKUP" ++while [ ! "$BACKUP" -nt out ]; do touch "$BACKUP"; done +--- /dev/null ++++ b/test/tools/autorestore/check-portable-character-set/in +@@ -0,0 +1 @@ ++TEST +--- /dev/null ++++ b/test/tools/autorestore/check-portable-character-set/out +@@ -0,0 +1 @@ ++TEST +--- /dev/null ++++ b/test/tools/autorestore/check-portable-character-set/rc +@@ -0,0 +1,2 @@ ++source "%val{runtime}/rc/tools/autorestore.kak" ++autorestore-restore-buffer diff -Nru kakoune-2024.05.18/debian/patches/series kakoune-2024.05.18/debian/patches/series --- kakoune-2024.05.18/debian/patches/series 2024-09-03 16:47:12.000000000 +0300 +++ kakoune-2024.05.18/debian/patches/series 2026-08-09 20:19:51.000000000 +0300 @@ -5,3 +5,4 @@ 07-readme-listing.patch 08-optimize.patch 09-parallel-dirs.patch +CVE-2026-48120.patch
signature.asc
Description: PGP signature
