Control: tags -1 - moreinfo Apologies; I thought the salsa MR might have been sufficient.
Attached now regards, Arif On Sat, 17 Oct 2026 at 06:45, Salvatore Bonaccorso <[email protected]> wrote: > Control: tags -1 + moreinfo > > Hi Arif, > > On Wed, Oct 14, 2026 at 05:36:44PM +0100, Arif Ali wrote: > > Package: release.debian.org > > Severity: normal > > User: [email protected] > > Usertags: pu > > Tags: trixie > > > > This fixes a path traversal security vulnerability (CVE-2026-79655) which > > was marked as <no-dsa>. > > > > If not fixed, then users using sos clean on untrusted archives could > suffer > > an arbitrary file overwrite/path traversal attack. > > > > Bug #1145981 and the CVE ID CVE-2026-79655 > > > > This is low risk, as the patches are direct backports of the upstream > fix, > > isolated strictly to the tar extraction verification logic inside the > clean > > component > > > > Debdiff below > > > > [ Reason ] > > sos has a CVE, CVE-2026-79655, which is a low risk for trixie, and has > > been uploaded to sid, forky, and trixie-backports > > > > [ Impact ] > > The users using sos clean on untrusted archives could suffer an > > arbitrary file overwrite/path traversal attack. > > > > [ Tests ] > > Ran the reproducer as defined in the upstream bug [1], shown below. > > The package was built on salsa, and installed on a trixie development > > machine. > > > > root@trixie-dev:~# python3 ./reproducer.py > > [cleaner] skipping tar member 'sosreport-test/var/log/escape': > > 'sosreport-test/var/log/escape' is a link to an absolute path > > OK: file did not escape the extraction directory > > > > [ Risks ] > > sos may not collect the corresponding files for evaluation overall > > > > [ Checklist ] > > [x] *all* changes are documented in the d/changelog > > [x] I reviewed all changes and I approve them > > [x] attach debdiff against the package in stable > > [x] the issue is verified as fixed in unstable > > Debdiff seems missing from this email, can you provide it and then > remove please the moreinfo tag? > > Regards, > Salvatore >
trixie-CVE.debdiff
Description: Binary data
