[From nobody Fri Oct 16 22:37:05 2026 Received: (at 1150902-close) by bugs.debian.org; 16 Oct 2026 21:34:44 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.7 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE,SPF_HELO_PASS, SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 140; hammy, 150; neutral, 269; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:48972) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHpZc-00FSpa-1e for 1150902-close@bugs.debian.org; Fri, 16 Oct 2026 21:34:44 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHpZb-0082Vd-08 for 1150902-close@bugs.debian.org; Fri, 16 Oct 2026 21:34:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=de2NzY5OF0WikQvzd7PkCYHoraxriFoo5qlyTiw/hpk=; b=ZCv66FOD9xSsbVeJ7ppBdU9ydP j7yOd4jIGl8aC3hY28KAzJvCTNXowOMRLOzvl4CgirOmum/ajldDRIU/OGHRn+ZEtDbZYXOElHSdY wRKyrkejm6BpSReaiYZKxq357NdBLw24nzEZ67/rUF8LjflT+SLCz5YMdhWr9vxbtZarQr2bAmwKr d0+esJIlVl51xPops7g6g4UhszoIVPtJQrKJDWvKzYk8YmxJBS/L++ld1H3AaQmgp35R9X/UGZluX zwUAS5uwmiwpxs2jVtKc5dNDx1fNIN3kHqicdx92C+2oXvAJp3+BbDyqzI6radt/yjmRwtnz2wmmw WEitjGkA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xHpZa-00000008jZv-0rv8; Fri, 16 Oct 2026 21:34:42 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Sergei Golovan <sgolovan@debian.org> To: 1150902-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: erlang-hex Debian: DAK Debian-Changes: erlang-hex_2.5.3-1_source.changes Debian-Source: erlang-hex Debian-Version: 2.5.3-1 Debian-Architecture: source Debian-Suite: experimental Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1150902: fixed in erlang-hex 2.5.3-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============7946325336009298726==" Message-Id: <E1xHpZa-00000008jZv-0rv8@fasolo.debian.org> Date: Fri, 16 Oct 2026 21:34:42 +0000 --===============7946325336009298726== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: erlang-hex Source-Version: 2.5.3-1 Done: Sergei Golovan <sgolovan@debian.org> We believe that the bug you reported is fixed in the latest version of erlang-hex, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1150902@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sergei Golovan <sgolovan@debian.org> (supplier of updated erlang-hex package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 17 Oct 2026 00:17:11 +0300 Source: erlang-hex Architecture: source Version: 2.5.3-1 Distribution: experimental Urgency: medium Maintainer: Debian Erlang Packagers <pkg-erlang-devel@lists.alioth.debian.org> Changed-By: Sergei Golovan <sgolovan@debian.org> Closes: 1150902 Changes: erlang-hex (2.5.3-1) experimental; urgency=3Dmedium . * Team upload. * New upstream release. - Fix CVE-2026-105274: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). Closes: #1150902. - Fix CVE-2026-103503: Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. - Fix CVE-2026-105280: Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. - Fix CVE-2026-105668: Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. - Fix CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. - Fix CVE-2026-96612: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. - Fix CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. * Bump debhelper compatibility level to 14. Checksums-Sha1: f836776718bf25c94698363e2f766367b2aff788 1936 erlang-hex_2.5.3-1.dsc b4e7b7a0961d1098607980f4e100f6a5762c245d 610397 erlang-hex_2.5.3.orig.tar.gz 8055e9d5c234a33196cbc4cb0a346d402ab6e857 3976 erlang-hex_2.5.3-1.debian.tar.= xz 43716abf0ec50a7213d1a6605cce671b2bc48620 6064 erlang-hex_2.5.3-1_amd64.build= info Checksums-Sha256: 4068b4079702d808f078fcf2d6ffb9c246ba37ae0c53f4c7930b7e5ced3236a8 1936 erlang= -hex_2.5.3-1.dsc 763398d6aa2a3a969d156b1ff74ff59f4be36484023b3e0a25fae524ed0f2213 610397 erla= ng-hex_2.5.3.orig.tar.gz c9ec95697a80d246f5fbe0f2d8aea10cbe3052fa4ba70e23ef0bb8ee0c1681f7 3976 erlang= -hex_2.5.3-1.debian.tar.xz 0598f9c7c6b72ab3940da1cd335c80354a1c94c2c65d0379cb78532aa209c59d 6064 erlang= -hex_2.5.3-1_amd64.buildinfo Files: fd94f32a638e9e2b220e9f09a282c157 1936 interpreters optional erlang-hex_2.5.3= -1.dsc 328389e56811a8d94c58712318fa8555 610397 interpreters optional erlang-hex_2.5= .3.orig.tar.gz 1fe919b3d464e08af06eb333451dfe7f 3976 interpreters optional erlang-hex_2.5.3= -1.debian.tar.xz 927b58942e87080cad64718fe7159e7b 6064 interpreters optional erlang-hex_2.5.3= -1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmrSlVUACgkQTyrk60tj 54ec2xAAmFgYKC101BI8hTKKiItI/HTVAyYOajCUKvoz+2S49ZiA4oUcuUhwV0ND fhD58va2g1pyEA0gc2IEjBDhDU1YcIuyym/ndC+i8ZCAR/rqHEmxF4jAv5WOPVRt mgK+34ACt8Bevo13pKWn7bnFm4Zihh6f7mR/k2132sfKlb+Vci9EJkHX1sMsG5RD B2XF+FUstiRCfWg81PEaK9h9Pli8lvjns2XV4olHSCepQLOWwqXkiZnWEIymxbbK QdY7dW7LmLysGT3WGkFDttaxCbdOpBUmid7x82zFgEEG7Bd12F3PEeIRlUf2f/zA tdhGXPpboH4R0TrLjiYxwGjGrjEFj2CBuUrAFqH3LdmkojGNWaRhSqKYnCtKiLiT PE4CJUAaS7/EqQR+qU9Boj0Hv1LEsn/3iZwzOsePvJqaXq9eXEVmKMcXXND5JecT fMZp8FrDe4H8tPgA+GkvwoQ82W9BjB+hVT+/QIqYLcyWBWxciqLFCodHukGHcN0e XMv/qN+eZ0nJoUYAlDi0d+4z570HiY7IBmBk4Y4s0/jTl1arEKPype8S5x6Zyaze JF+owbVOMemlsopE3mTuTBRbJi70Oa8mbzvdKrJLRNwjySu5oSlAvFdniw5cYEde ZtAlvPC6RKqRucTopav1KMGvaFl3R56DFJAJkHdzE9r1nY1/hbE=3D =3DpsWe -----END PGP SIGNATURE----- --===============7946325336009298726== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatKYcgAKCRCb9qggYcy5 IQxJAQCcA4HTn65sqmpF/t4WEUsRNM1DXUm84jHGZk7M5GKikwEAqJBUkpdv1+6n pVrowfGZd1wAOgpbprNUyvwpmDf3qQU= =IREj -----END PGP SIGNATURE----- --===============7946325336009298726==-- ]