Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] User: [email protected] Usertags: pu
[ Reason ] The patch that I backported for CVE-2026-81524 had a defect, as reported in #1150302. This upload is a targeted fix of only that defect. Based on the feedback from Emilio, I have gone ahead and uploaded with a target distribution of 'trixie' and I would like to see this update published as a SUA rather than waiting for the next point release. Please see the discussion in #1150302 for details. [ Impact ] Users have the possibility of experiencing failures in applications that they have built against libmongoc-dev. [ Tests ] The reporter of #1150302 has confirmed the correctness of the fix, and I have also reviewed the change and I agree that the fix is correct. [ Risks ] The fix is trivial, and presents an extremely low risk of further regression. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [*] the issue is verified as fixed in unstable The issue does not exist in unstable, as the defect was introduced while backporting the fix. [ Changes ] Fix the ordering of function parameters so that the declaration and the definition have the same function ordering.
diff -Nru mongo-c-driver-1.30.4/debian/changelog mongo-c-driver-1.30.4/debian/changelog --- mongo-c-driver-1.30.4/debian/changelog 2026-08-29 11:06:27.000000000 -0400 +++ mongo-c-driver-1.30.4/debian/changelog 2026-10-09 21:12:28.000000000 -0400 @@ -1,3 +1,10 @@ +mongo-c-driver (1.30.4-1+deb13u4) trixie; urgency=medium + + * Follow up to fix CVE-2026-81524: correct parameter ordering in function + definition. Thanks to Jeevan Chalke for the patch. (Closes: #1150302) + + -- Roberto C. Sanchez <[email protected]> Fri, 09 Oct 2026 21:12:28 -0400 + mongo-c-driver (1.30.4-1+deb13u3) trixie; urgency=medium * Fix CVE-2026-81524: validate db and collection names diff -Nru mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch --- mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch 2026-08-29 11:06:27.000000000 -0400 +++ mongo-c-driver-1.30.4/debian/patches/0009_CVE-2026-81524.patch 2026-10-09 21:12:28.000000000 -0400 @@ -32,22 +32,22 @@ const bson_t *opts, --- a/src/libmongoc/src/mongoc/mongoc-aggregate.c +++ b/src/libmongoc/src/mongoc/mongoc-aggregate.c -@@ -185,6 +185,7 @@ - * information on how to build aggregation pipelines. +@@ -186,6 +186,7 @@ * * Parameters: -+ * @db: Database name used. Separated from @ns to validate. * @ns: Namespace (or database name for database-level aggregation). ++ * @db: Database name used. Separated from @ns to validate. * @flags: Bitwise or of mongoc_query_flags_t or 0. * @pipeline: A bson_t containing the pipeline request. @pipeline -@@ -210,6 +211,7 @@ - + * will be sent as an array type in the request. +@@ -211,6 +212,7 @@ mongoc_cursor_t * _mongoc_aggregate (mongoc_client_t *client, -+ const char *db, const char *ns, ++ const char *db, mongoc_query_flags_t flags, const bson_t *pipeline, + const bson_t *opts, @@ -237,6 +239,7 @@ BSON_ASSERT (client);
