[From nobody Wed Nov 4 21:09:12 2026 Received: (at submit) by bugs.debian.org; 24 Jul 2026 06:19:21 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 34; hammy, 150; neutral, 121; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wn9Fg-00FFBW-1c for submit@bugs.debian.org; Fri, 24 Jul 2026 06:19:21 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: mina2: CVE-2026-56452 CVE-2026-56624 CVE-2026-58624 Message-ID: <178487395981.1024535.6269975566993273524.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Fri, 24 Jul 2026 08:19:19 +0200 Delivered-To: submit@bugs.debian.org U291cmNlOiBtaW5hMgpWZXJzaW9uOiAyLjIuMS00ClNldmVyaXR5OiBpbXBvcnRhbnQKVGFnczog c2VjdXJpdHkgdXBzdHJlYW0KWC1EZWJidWdzLUNjOiBjYXJuaWxAZGViaWFuLm9yZywgRGViaWFu IFNlY3VyaXR5IFRlYW0gPHRlYW1Ac2VjdXJpdHkuZGViaWFuLm9yZz4KCkhpLAoKVGhlIGZvbGxv d2luZyB2dWxuZXJhYmlsaXRpZXMgd2VyZSBwdWJsaXNoZWQgZm9yIG1pbmEyLgoKQ1ZFLTIwMjYt NTY0NTJbMF06CnwgUGF0aCB0cmF2ZXJzYWwgaW4gdGhlIHNzaGQtc2NwIGNvbXBvbmVudCBvZiBB cGFjaGUgTUlOQSBTU0hELsKgQXBhY2hlCnwgTUlOQSBTU0hEIGlzIGEgSmF2YSBsaWJyYXJ5IGZv ciBjbGllbnQtc2lkZSBhbmQgc2VydmVyLXNpZGUgU1NILgp8IFRoZSBpbXBsZW1lbnRhdGlvbiBv ZiByZWNlaXZpbmcgZmlsZXMgb3IgZGlyZWN0b3JpZXMgdmlhIFNDUCBkaWQgbm90CnwgdmFsaWRh dGUgZmlsZW5hbWVzIGluIFNDUCAiQyIgb3IgIkQiIGNvbW1hbmRzLiBBIG1hbGljaW91cyBzZW5k ZXIKfCBjb3VsZCBzZW5kIGZpbGVuYW1lcyBjb250YWluaW5nIHBhdGhzLCByZXN1bHRpbmcgaW4g ZmlsZXMgdG8gYmUKfCB3cml0dGVuIGluIGF0dGFja2VyLWNvbnRyb2xsZWQgcGxhY2VzLiAgICAg VGhlIGlzc3VlIGFmZmVjdHMgb25seQp8ICogIGFwcGxpY2F0aW9ucyB0aGF0IHVzZSBubyBsb25n ZXIgc3VwcG9ydGVkIEFwYWNoZSBNSU5BIFNTSEQKfCB2ZXJzaW9ucyA8IDIuMC4wIGFuZCB1c2Ug dGhlIFNDUCBmdW5jdGlvbnMgdG8gcmVjZWl2ZSBmaWxlcywgICAqICBvcgp8IGFwcGxpY2F0aW9u cyB1c2luZyBzc2hkLXNjcCBpbiBBcGFjaGUgTUlOQSBTU0hEID49IDIuMC4wIHRvIHJlY2VpdmUK fCBmaWxlcy4gICAgIEFwcGxpY2F0aW9ucyB1c2luZyBBcGFjaGUgTUlOQSBTU0hEID49IDIuMC4w IG5vdCB1c2luZwp8IHNzaGQtc2NwIGFyZSBub3QgYWZmZWN0ZWQuICAgICBUaGUgaXNzdWUgaXMg Zml4ZWQgaW4gQXBhY2hlIE1JTkEKfCAyLjE5LjAgYW5kIDMuMC4wLU01LiBBZmZlY3RlZCBhcHBs aWNhdGlvbnMgYXJlIGFkdmlzZWQgdG8gdXBncmFkZSB0bwp8IHRoZXNlIHZlcnNpb25zLgoKCkNW RS0yMDI2LTU2NjI0WzFdOgp8IEltcHJvcGVyIGNlcnRpZmljYXRlIHZhbGlkYXRpb24gaW4gQXBh Y2hlIE1JTkEgU1NIRCAoc2VydmVyLQp8IHNpZGUpLsKgQXBhY2hlIE1JTkEgU1NIRCBpcyBhIEph dmEgbGlicmFyeSBmb3IgY2xpZW50LXNpZGUgYW5kCnwgc2VydmVyLXNpZGUgU1NILiAgICAgU2Vy dmVyLXNpZGUgT3BlblNTSCB1c2VyIGNlcnRpZmljYXRlIHZhbGlkYXRpb24KfCBkdXJpbmcgdXNl ciBhdXRoZW50aWNhdGlvbiBpbiBhbiBBcGFjaGUgTUlOQSBTU0hEIHNlcnZlciBkaWQgbm90Cnwg Y2hlY2sgZm9yIHRoZSB1bnN1cHBvcnRlZCBmb3JjZS1jb21tYW5kIG9yIHZlcmlmeS1yZXF1aXJl ZCBvcHRpb25zCnwgdGhhdCBjb3VsZCBiZSBlbWJlZGRlZCBpbiB0aGUgY2VydGlmaWNhdGUsIG5v ciBkaWQgaXQgdmFsaWRhdGUgdGhlc2UKfCBvcHRpb25zLiBBcyBhIHJlc3VsdCBpdCB3YXMgcG9z c2libGUgdGhhdCBhIHVzZXIgY291bGQgYXV0aGVudGljYXRlCnwgd2l0aCBzdWNoIGEgY2VydGlm aWNhdGUgdGhhdCBpbmNsdWRlZCBhIGZvcmNlLWNvbW1hbmQgb3B0aW9uIGJ1dAp8IHN0aWxsIHdh cyBhYmxlIHRvIGV4ZWN1dGUgb3RoZXIgY29tbWFuZHMuIFdoYXQgb3RoZXIgY29tbWFuZCBleGFj dGx5Cnwgd291bGQgYmUgYXZhaWxhYmxlIHRvIHRoZSB1c2VyIGRlcGVuZHMgb24gdGhlIGltcGxl bWVudGF0aW9uIG9mIHRoZQp8IHNlcnZlci4gICAgIFRoaXMgaXNzdWUgaXMgZml4ZWQgaW4gQXBh Y2hlIE1JTkEgU1NIRCAyLjE5LjAgYW5kCnwgMy4wLjAtTTUuIEFwcGxpY2F0aW9ucyBhcmUgYWR2 aXNlZCB0byB1cGdyYWRlIHRvIHRoZXNlIHZlcnNpb25zLgp8IFRoZSBmaXggcmVqZWN0cyBPcGVu U1NIIHVzZXIgY2VydGlmaWNhdGVzIHRoYXQgaW5jbHVkZSB0aGVzZQp8IG9wdGlvbnMsIHNpbmNl IEFwYWNoZSBNSU5BIFNTSEQgaW1wbGVtZW50cyBuZWl0aGVyIGZvcmNlLWNvbW1hbmQgbm9yCnwg c2stKi1jZXJ0LXYwMUBvcGVuc3NoLmNvbSB1c2VyIGNlcnRpZmljYXRlcyAod2hpY2ggYXJlIHRo ZSBvbmx5IG9uZXMKfCBmb3Igd2hpY2ggdmVyaWZ5LXJlcXVpcmVkIHdvdWxkIG1ha2Ugc2Vuc2Up LgoKCkNWRS0yMDI2LTU4NjI0WzJdOgp8IEltcHJvcGVyIGlucHV0IHZhbGlkYXRpb24gaW4gc3No ZC1naXQgaW4gQXBhY2hlIE1JTkEgU1NIRC4gQXBhY2hlCnwgTUlOQSBTU0hEIGlzIGEgSmF2YSBs aWJyYXJ5IGZvciBjbGllbnQtc2lkZSBhbmQgc2VydmVyLXNpZGUgU1NILgp8IENvbXBvbmVudCBv cmcuYXBhY2hlLnNzaGQ6c3NoZC1naXQgcHJvdmlkZXMgdGhvdWdoIGl0cwp8IEdpdFBnbUNvbW1h bmRGYWN0b3J5IGEgd2F5IHRvIGNvbmZpZ3VyZSBhbiBBcGFjaGUgTUlOQSBTU0hEIHNlcnZlcgp8 IHN1Y2ggdGhhdCBTU0ggY2xpZW50cyBjYW4gcmVtb3RlbHkgZXhlY3V0ZSBnaXQgY29tbWFuZHMg dmlhIHRoZSBKR2l0CnwgbGlicmFyeSBvbiBnaXQgcmVwb3NpdG9yaWVzIHN0b3JlZCBvbiB0aGUg c2VydmVyLiAgICAgVGhpcwp8IEdpdFBnbUNvbW1hbmRGYWN0b3J5IGFsbG93ZWQgYSB1c2VyIGF1 dGhlbnRpY2F0ZWQgdmlhIFNTSCB0byBydW4gYW55CnwgSkdpdCBjb21tYW5kIGF2YWlsYWJsZSwg aW5jbHVkaW5nIGNvbW1hbmRzIHRoYXQgY291bGQgd3JpdGUgZmlsZXMgYXQKfCBhcmJpdHJhcnkg cGxhY2VzIHN1Y2ggYXMgZ2l0IGFyY2hpdmUgd2l0aCB0aGUgLS1vdXRwdXQgb3B0aW9uLgp8IEFm ZmVjdGVkIGFyZSBTU0ggc2VydmVycyBpbXBsZW1lbnRlZCB3aXRoIEFwYWNoZSBNSU5BIFNTSEQg YW5kIHVzaW5nCnwgdGhlIEdpdFBnbUNvbW1hbmRGYWN0b3J5LiBJZiB0aGUgR2l0UGdtQ29tbWFu ZEZhY3RvcnkgaXMgbm90CnwgY29uZmlndXJlZCBvbiB0aGUgc2VydmVyLCB0aGUgc2VydmVyIGlz IG5vdCBhZmZlY3RlZC4gICAgIEl0IGlzCnwgcmVjb21tZW5kZWQgdG8gdXBncmFkZSBhZmZlY3Rl ZCBzZXJ2ZXJzIHRvIEFwYWNoZSBNSU5BIFNTSEQgMi4xOS4wCnwgb3IgMy4wLjAtTTUsIHdoaWNo IGZpeCB0aGlzIGlzc3VlLiAgICAgVGhlIGlzc3VlIGlzIGZpeGVkIGJ5CnwgcmVzdHJpY3Rpbmcg dGhlIGF2YWlsYWJsZSBjb21tYW5kcyB0byBhIHNtYWxsIHdoaXRlbGlzdCBvZgp8IHVuY3JpdGlj YWwgY29tbWFuZHMgKHN1Y2ggYXMgZ2l0IGxvZykuIGdpdCBhcmNoaXZlIGlzIGFsc28gYWxsb3dl ZCwKfCBidXQgaXRzIC0tb3V0cHV0IGFyZ3VtZW50IGlzIGlnbm9yZWQgYW5kIHRoZSBhcmNoaXZl IGlzIGFsd2F5cyBzZW50CnwgdGhyb3VnaCB0aGUgU1NIIGNoYW5uZWwgdG8gdGhlIGNsaWVudC4K CgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXRpZXMgcGxlYXNlIGFsc28gbWFrZSBzdXJlIHRv IGluY2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykgaWRz IGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIgaW5mb3JtYXRpb24gc2VlOgoK WzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZFLTIwMjYt NTY0NTIKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2LTU2NDUy ClsxXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NWRS0yMDI2 LTU2NjI0CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi01NjYy NApbMl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUtMjAy Ni01ODYyNAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYtNTg2 MjQKClJlZ2FyZHMsClNhbHZhdG9yZQo= ]