Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu X-Debbugs-Cc: [email protected] Control: affects -1 + src:pymongo
Dear Release Team, Please consider pymongo 4.10.1-6+deb13u1 for the next trixie point release. I am requesting pre-approval before arranging an upload. [ Reason ] Backport the upstream fix for CVE-2026-106435 / #1150462 (severity important). Trixie 4.10.1-6 contains unbounded regular-expression scans in the native BSON decoder. The Security Tracker marks this no-dsa. The fix entered Debian unstable in 4.19.0-1, remains in 4.19.0-2, and is also in testing. This candidate carries only upstream commit bb8d4e195275e75bd94ebeffb53cc747d357fcf4 and its two regression tests. [ Impact ] An application decoding untrusted, malformed BSON through decode or decode_all can terminate when the C extension is loaded. Normal database wire-protocol decoding does not reach this code. This is a focused proposed update for an existing flaw in trixie, with normal maintenance priority. [ Tests ] Tests completed on 18 October 2026 in a trixie amd64 chroot with Python 3.13.5, using the built Debian packages: - sbuild succeeded: 806 passed, 3703 skipped, 788 deselected, 2 warnings. - The same BSON suite, including the upstream regressions, gave 83 passed, 1 failed, 1 skipped on 4.10.1-6; the candidate gave 84 passed, 0 failed, 1 pre-existing skip. Both new methods pass. - Both C extensions were loaded from the built .deb files; their hashes matched the package contents. - The declared autopkgtest passed as a superficial import test (exit 8). BSON/C regression coverage comes from the separate comparison above. MongoDB was not used. The attached validation summary describes the existing runs and their limits; no new test run is claimed for today. [ Risks ] The runtime change is confined to C BSON regular-expression decoding, replacing unbounded scans with searches bounded by the remaining document bytes. Regression risks are incorrect bounds handling or rejection of valid regex values; the BSON suite covers valid data as well as the new malformed-data cases. No external dependency or public API changes are introduced. The four existing Debian patches are retained. [ Checklist ] [x] All changes are documented in debian/changelog. [x] The complete source diff has been reviewed locally. [x] A source debdiff against trixie 4.10.1-6 is attached. [x] The issue is fixed in unstable. [ Changes ] The debdiff changes exactly three Debian files: - debian/changelog: document CVE-2026-106435 / #1150462. - debian/patches/00006_CVE-2026-106435.patch: upstream fix and two tests. - debian/patches/series: enable that patch. [ Other info ] I maintain pymongo within the Debian Python Team and am a Debian Maintainer. Aryan is copied for coordination; a stable uploader has not yet been arranged. The Security Team was contacted. On 29 October Salvatore Bonaccorso said he was not aware of parallel work on a trixie update and suggested filing a pu bug in coordination with the maintainer. The attached debdiff is the tested, unsigned UNRELEASED candidate. The changelog distribution will be set to trixie and its date finalised before an approved upload. No upload has been made. For the Debian Python Team: would a Salsa MR be useful for packaging review? If so, which repository and target branch should I use? The local work is on the separate work/trixie-1150462 branch. Attachments: source debdiff and validation summary. Full logs and the unsigned source package are available on request. References: https://bugs.debian.org/1150462 https://security-tracker.debian.org/tracker/CVE-2026-106435 https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4 Best regards, Federico Molara
pymongo_4.10.1-6_to_4.10.1-6+deb13u1.debdiff
Description: Binary data
pymongo trixie candidate: CVE-2026-106435 / Debian #1150462
Validation summary prepared 2026-10-26 from the recorded 2026-10-18 runs.
Candidate and scope
-------------------
Baseline: Debian trixie source pymongo 4.10.1-6.
Candidate: 4.10.1-6+deb13u1, changelog still UNRELEASED, unsigned.
Candidate Git commit: cafc9c43921b6565da7c1286d1a92654dda772f4
Upstream fix: bb8d4e195275e75bd94ebeffb53cc747d357fcf4 (PYTHON-6110),
first included upstream in 4.18.3. Debian unstable/testing contain the
fix in 4.19.0-1.
The candidate contains the upstream C BSON regex bounds fix and its two
regression tests, carried as a DEP-3 quilt patch. The source debdiff changes
exactly debian/changelog, debian/patches/series and the new
00006_CVE-2026-106435.patch. The four existing Debian patches are retained.
Validation environment and date
-------------------------------
Debian trixie amd64, Python 3.13.5, using temporary schroot overlays.
Candidate build, BSON comparisons and autopkgtest completed on 2026-10-18.
This report does not represent a new build or test run on 2026-10-26.
MongoDB was not used in these runs.
1. Candidate sbuild
-------------------
Successful amd64 and arch-all build, exit 0.
Build tests: 806 passed, 3703 skipped, 788 deselected, 2 warnings.
The two additional passes over the baseline are the regex regressions;
the baseline has 804 passed with the same skip/deselection counts.
Build warnings are the existing GridIn.contentType deprecations.
2. BSON baseline/candidate comparison
-------------------------------------
The same test_bson.py was used in both runs: the release's test module
with the two upstream regression methods added in a temporary test tree.
The tests exercised the respective built Debian binary packages.
Baseline 4.10.1-6: 83 passed, 1 failed, 1 skipped; exit 1.
test_malformed_regex failed because InvalidBSON was not raised.
test_regex_empty_flags passed.
Candidate 4.10.1-6+deb13u1: 84 passed, 0 failed, 1 skipped; exit 0.
test_malformed_regex and test_regex_empty_flags both passed without skips.
The one skip is the pre-existing test_bad_encode/CPython issue25222 skip.
Native module checks for both runs confirmed bson.has_c() and
pymongo.has_c() are true. Both loaded extensions came from the respective
Debian package extraction, and their hashes matched those package files.
Candidate extension SHA256:
bson._cbson:
437646b721f79b5e70a384de257f190b989d618dced0919be2da00a4667e4251
pymongo._cmessage:
5eb345fdc7e15fcde312a0725e230cb1b3d957b31ba177751871e42caedd3e60
3. Declared autopkgtest
-----------------------
Baseline and candidate: autodep8-python3 PASS (superficial), exit 8.
This is an import smoke test only; exit 8 records the absence of
non-superficial tests. BSON/C regression coverage comes from section 2,
not from the generated import test. These runs do not establish server
integration coverage.
4. Package review
------------------
Source debdiff: changes limited to the three Debian files listed above.
Binary debdiff: package versions/internal versioned dependencies and
debug build IDs change; no external dependency change was introduced.
Full build/test logs and the unsigned source package can be provided
for review.
References
-----------
https://bugs.debian.org/1150462
https://security-tracker.debian.org/tracker/CVE-2026-106435
https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
