Your message dated Sat, 12 Sep 2026 08:05:42 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1146731,
regarding trixie-pu: package socat/1.8.0.3-1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146731: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146731
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:socat
User: [email protected]
Usertags: pu
Fixes a low severity security issue. All tests in debusine look
good and the patch has been reviewed by the maintainer as well.
debdiff below.
Cheers,
Moritz
diff -Nru socat-1.8.0.3/debian/changelog socat-1.8.0.3/debian/changelog
--- socat-1.8.0.3/debian/changelog 2025-03-31 22:50:04.000000000 +0200
+++ socat-1.8.0.3/debian/changelog 2026-09-03 22:58:48.000000000 +0200
@@ -1,3 +1,9 @@
+socat (1.8.0.3-1+deb13u1) trixie; urgency=medium
+
+ * CVE-2026-56123
+
+ -- Moritz Mühlenhoff <[email protected]> Thu, 03 Sep 2026 22:58:48 +0200
+
socat (1.8.0.3-1) unstable; urgency=medium
[ Bastian Germann <[email protected]> ]
diff -Nru socat-1.8.0.3/debian/patches/CVE-2026-56123.patch
socat-1.8.0.3/debian/patches/CVE-2026-56123.patch
--- socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 1970-01-01
01:00:00.000000000 +0100
+++ socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 2026-09-03
22:57:59.000000000 +0200
@@ -0,0 +1,122 @@
+From d44cd1cc4fbb70a9ae9e71890024ae8367fcb912 Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <[email protected]>
+Date: Thu, 25 Jun 2026 14:55:59 +0200
+Subject: [PATCH] Version 1.8.1.2 - fixed SOCKS5 client buffer overflow
+ (CVE-2026-56123)
+
+From af5388c898c7bb60997935aee93c223deba60c4a Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <[email protected]>
+Date: Fri, 26 Jun 2026 07:53:54 +0200
+Subject: [PATCH] Version 1.8.1.3 - corrected test for non-bash
+
+
+--- socat-1.8.0.3.orig/test.sh
++++ socat-1.8.0.3/test.sh
+@@ -615,6 +615,9 @@ rm -rf "$TD" || (echo "cannot rm $TD" >&
+ mkdir -p "$TD"
+ #trap "rm -r $TD" 0 3
+
++BINDIR=$td/bin
++mkdir -p $BINDIR
++
+ echo "Using temp directory $TD"
+
+ RESULTS="$TD/results.txt" # file for list of results
+@@ -20412,6 +20415,77 @@ PROXY tcp CONNECT 127.0.0.1:80 proxyp
+ # test combined 4_6/6_4 with retry and fork
+
+
++# Above tests introduced with 1.8.1.0 (none with 1.8.1.1)
++#==============================================================================
++# Below tests introduced with 1.8.1.2
++
++
++# Test socks5 client buffer overflow (CVE-2026-56123)
++NAME=SOCKS5_OVERFL
++case "$TESTS" in
++*%$N%*|*%functions%*|*%bugs%*|*%security%*|*%socks5%*|*%socks%*|*%%*|*%%*|*%socket%*|*%$NAME%*)
++#*%internet%*|*%root%*|*%listen%*|*%fork%*|*%ip4%*|*%tcp4%*|*%bug%*|...
++TEST="$NAME: socks5 client buffer overflow"
++# Start a listener that emulates a malicious socks5 server, using a temporary
++# shell script;
++# connect using Socat with socks5 client;
++# when is terminates with rc=0 the test succeeded (not vulnerable)
++if ! eval $NUMCOND; then :
++# Check if this test can be performed meaningfully
++elif ! cond=$(checkconds \
++ "" \
++ "" \
++ "" \
++ "IP4 TCP LISTEN SHELL GOPEN SOCKS5" \
++ "TCP4-LISTEN SHELL GOPEN SOCKS5" \
++ "socksport" \
++ "tcp4" ); then
++ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
++ cant
++else
++ mkdir -p "$BINDIR"
++ tf="$td/test$N.stdout"
++ te="$td/test$N.stderr"
++ tdiff="$td/test$N.diff"
++ tsh="$BINDIR/test$N.sh"
++ cat >"$tsh" <<__EOF__
++#! /usr/bin/env bash
++$ECHO -n "\\x05\\x00"
++relsleep 1
++$ECHO -n
"\\x05\\x00\\x00\\x03\\xfdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
++__EOF__
++ chmod a+x "$tsh"
++ newport tcp4 # -> PORT
++ CMD0="$TRACE $SOCAT $opts TCP4-LISTEN:$PORT SHELL:$tsh"
++ CMD1="$TRACE $SOCAT $opts /dev/null
SOCKS5:$LOCALHOST4:17.34.51.68:85,socksport=$PORT"
++ printf "test $F_n $TEST... " $N
++ $CMD0 >/dev/null 2>"${te}0" &
++ pid0=$!
++ waittcp4port $PORT 1
++ $CMD1 >"${tf}1" 2>"${te}1"
++ rc1=$?
++ kill $pid0 2>/dev/null; wait
++ if [ "$rc1" -ne 0 ]; then
++ $PRINTF "$FAILED (rc1=$rc1)\n"
++ echo "$CMD0 &"
++ cat "${te}0" >&2
++ echo "$CMD1"
++ cat "${te}1" >&2
++ failed
++ else
++ $PRINTF "$OK\n"
++ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
++ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi
++ if [ "$VERBOSE" ]; then echo "$CMD1"; fi
++ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi
++ ok
++ fi
++fi # NUMCOND
++ ;;
++esac
++N=$((N+1))
++
++
+ # end of common tests
+
+
##################################################################################
+--- socat-1.8.0.3.orig/xio-socks5.h
++++ socat-1.8.0.3/xio-socks5.h
+@@ -23,7 +23,7 @@ struct socks5_request {
+ uint8_t command;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ struct socks5_reply {
+@@ -31,7 +31,7 @@ struct socks5_reply {
+ uint8_t reply;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ extern const struct addrdesc xioaddr_socks5_connect;
diff -Nru socat-1.8.0.3/debian/patches/series
socat-1.8.0.3/debian/patches/series
--- socat-1.8.0.3/debian/patches/series 2025-03-31 22:50:04.000000000 +0200
+++ socat-1.8.0.3/debian/patches/series 2026-09-03 22:57:15.000000000 +0200
@@ -5,3 +5,4 @@
07-compat-define-PATH_MAX.patch
08-test.sh-fixes.patch
09-xioinitialize.c.patch
+CVE-2026-56123.patch
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
