Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:electrum User: [email protected] Usertags: pu
[ Reason ] Electrum 4.5.8+ds-6 in trixie is vulnerable to CVE-2026-117601. https://security-tracker.debian.org/tracker/CVE-2026-117601 Moritz Mühlenhoff <[email protected]> from the Debian Security team advised that I fix this via the upcoming trixie point release instead of through trixie-security. [ Impact ] This vulnerability could lead to a loss of user funds. [ Tests ] This patch was prepared and manually tested by upstream. It includes an automated test that runs during build and autopkgtest. https://github.com/spesmilo/electrum/issues/11099 [ Risks ] Because this patch was custom-backported by upstream, I think the risks are minimal. If one does arise, I would expect that upstream would assist in addressing it. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] This adds a single patch named fix-CVE-2026-117601.patch which backports the seven commits that fix this issue. [ Other info ] I am coordinating with debian-lts to fix this issue in bookworm. https://lists.debian.org/debian-lts/2026/11/msg00055.html
