Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], Paulo Henrique de Lima Santana <[email protected]>, [email protected] Control: affects -1 + src:flask-socketio User: [email protected] Usertags: pu
[ Reason ] Fixing CVE-2026-27205 within flask changed the API and broke flask-socketio. The outcome was that onionshare chat cannot be used anymore on Trixie (#1136892). The API change in flask is known with 3.1.3 and flask-socketio 5.6.1 already adopted the API change (#1132356), that got uploaded to unstable. [ Impact ] Every application used to write RequestContext.session is broken and cannot be used anymore. One application is onionshare, the chat mode. [ Tests ] flask-socketio own testsuite discovered this breakage [1] and debusine [2] shows that the testsuite is fixed with the current packported patch. Built myself and tested locally. [1] https://lists.debian.org/debian-lts/2026/07/msg00080.html [2] https://debusine.debian.net/debian/developers/work-request/1558905/ [ Risks ] The source of this patch is from upstream, that is stripped down to a minimal change that fixes that adopt the API change done by fixing CVE-2026-27205. As the patch itself does not change the API of flask-socketio, I expect that the risk of this fix is very minimal. Especially it uses duck-typing, so it should adopt the corret API of flask in either way. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] * Added part of upstream patch to adopt new flask API. * Update gbp.conf debian-branch to debian/trixie. [ Other info ] Myself is not the Mantainer of flask-socketio. I asked phls if I should/can do the pu. phls answered me on 2026-10-28 by email: > I've never done a pu :-) > So, If you can do it, go ahead. I will follow to learn how to do it. I hope this is enough evidence, that I work together with the mantainer of flask-socketio. I didn't upload as I don't know if I should remark it somehow, that I'm not the mantainer. Regards, hefee
diff -Nru flask-socketio-5.5.1/debian/changelog flask-socketio-5.5.1/debian/changelog --- flask-socketio-5.5.1/debian/changelog 2025-03-12 17:06:11.000000000 +0100 +++ flask-socketio-5.5.1/debian/changelog 2026-10-22 18:09:19.000000000 +0200 @@ -1,3 +1,11 @@ +flask-socketio (5.5.1-1+deb13u1) trixie; urgency=medium + + * gbp.conf debian-branch to debian/trixie. + * Fix breakage introduced by CVE-2026-27205 (Closes: #1150205) + - Add upstream patch that use the updated Flask API. + + -- Sandro Knauß <[email protected]> Thu, 22 Oct 2026 18:09:19 +0200 + flask-socketio (5.5.1-1) unstable; urgency=medium * New upstream version 5.5.1. diff -Nru flask-socketio-5.5.1/debian/gbp.conf flask-socketio-5.5.1/debian/gbp.conf --- flask-socketio-5.5.1/debian/gbp.conf 2025-03-12 17:05:40.000000000 +0100 +++ flask-socketio-5.5.1/debian/gbp.conf 2026-10-22 18:09:19.000000000 +0200 @@ -1,4 +1,4 @@ [DEFAULT] -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream pristine-tar = True diff -Nru flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch --- flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 1970-01-01 01:00:00.000000000 +0100 +++ flask-socketio-5.5.1/debian/patches/0001-Fix-breakage-introduced-by-CVE-2026-27205.patch 2026-10-22 18:09:19.000000000 +0200 @@ -0,0 +1,36 @@ +From: =?utf-8?q?Sandro_Knau=C3=9F?= <[email protected]> +Date: Mon, 19 Oct 2026 19:55:37 +0200 +Subject: Fix breakage introduced by CVE-2026-27205 + +The patch to fix CVE-2026-27205 changed API of Flask. This patch +updates the API usage to get flask-socketio working again. + +cherry-picked only a hunk of 956f8f2847c53d5156620b395912b7c916e15a1b + +Author: Miguel Grinberg <[email protected]> +Origin: upstream, https://github.com/miguelgrinberg/Flask-SocketIO/commit/956f8f2847c53d5156620b395912b7c916e15a1b +Debian-Bug: https://bugs.debian.org/1150205 +Forwarded: not-needed +--- + src/flask_socketio/__init__.py | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/flask_socketio/__init__.py b/src/flask_socketio/__init__.py +index 219f30c..8e2cc8f 100644 +--- a/src/flask_socketio/__init__.py ++++ b/src/flask_socketio/__init__.py +@@ -813,7 +813,13 @@ class SocketIO: + else: # pragma: no cover + # update session for Flask < 2.2 + ctx = flask._request_ctx_stack.top +- ctx.session = session_obj ++ if hasattr(ctx, '_session'): ++ # update session for Flask >= 3.1.3 ++ # and Debian backported version (fixed CVE-2026-27205) ++ ctx._session = session_obj ++ else: ++ # update session for Flask < 3.1.3 ++ ctx.session = session_obj + else: + # let Flask handle the user session + # for cookie based sessions, this effectively freezes the diff -Nru flask-socketio-5.5.1/debian/patches/series flask-socketio-5.5.1/debian/patches/series --- flask-socketio-5.5.1/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ flask-socketio-5.5.1/debian/patches/series 2026-10-22 18:09:19.000000000 +0200 @@ -0,0 +1 @@ +0001-Fix-breakage-introduced-by-CVE-2026-27205.patch
