[From nobody Wed Nov 4 21:09:12 2026 Received: (at 1142679-close) by bugs.debian.org; 4 Nov 2026 21:08:19 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 102; hammy, 150; neutral, 318; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:42544) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOiDS-00BxYt-36 for 1142679-close@bugs.debian.org; Wed, 04 Nov 2026 21:08:19 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xOiDR-00ArW5-1m for 1142679-close@bugs.debian.org; Wed, 04 Nov 2026 21:08:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=2MiNX8M6G536y+38KkxwtQOXZRJNp+IA6IbseJHCX9w=; b=CrANCg25Lbzh2EuigSU7jgjr8x FqrauXlyNJtKijtZTnH8Wlf2mEmpEGgu1s1rk223WCr91XqXRki+N1MJH1hG+lpqtdbkJUXVbSHdi /6KskXxlmBndrOB5Q5UvWn3vuc9SfMYpG5oy8CVp6BE9FTdznhaOLdQ67fm1hNAWRD5KePBULKcoz 826OGHoroyoDz+1Ob1we3ri7IoOjy5AtOqp6aeOzT98r8dpkp1Q7gk7XsAs4afS/O4GwuvKuCBFEx moWacCbb/tE0++RDTueoergUXwL9Rdn1GbY5elRHvAE0FgUyg4u8u3PDhFuPi6MEg1mEYlEW/zTdE 0THSNh0Q==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xOiDQ-00000001UKq-30UT; Wed, 04 Nov 2026 21:08:16 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Pierre Gruet <pgt@debian.org> To: 1142679-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libmina-sshd-java Debian: DAK Debian-Changes: libmina-sshd-java_2.19.0-1_source.changes Debian-Source: libmina-sshd-java Debian-Version: 2.19.0-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1142679: fixed in libmina-sshd-java 2.19.0-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3980696583357120749==" Message-Id: <E1xOiDQ-00000001UKq-30UT@fasolo.debian.org> Date: Wed, 04 Nov 2026 21:08:16 +0000 X-CrossAssassin-Score: 2 --===============3980696583357120749== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libmina-sshd-java Source-Version: 2.19.0-1 Done: Pierre Gruet <pgt@debian.org> We believe that the bug you reported is fixed in the latest version of libmina-sshd-java, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1142679@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Pierre Gruet <pgt@debian.org> (supplier of updated libmina-sshd-java package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 21:31:50 +0100 Source: libmina-sshd-java Architecture: source Version: 2.19.0-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1138634 1142679 Changes: libmina-sshd-java (2.19.0-1) unstable; urgency=3Dmedium . * New upstream version 2.19.0: Fixes the following CVE: - CVE-2026-48827: Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. - CVE-2026-56452: Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. - CVE-2026-56624: Improper certificate validation in Apache MINA SSHD (server- side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. - CVE-2026-58624: Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server. This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option. Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected. (Closes: #1138634, #1142679) * Refreshing patches * Switching to debhelper-compat 14, removing misc: substvar * Raising Standards version to 4.7.4: - Removing Priority: optional, which is now defaults - Removing R-R-R: no, which is now defaults * Raising d/watch version to 5 * Skipping second and identical run of tests with mina 2.2.x * Skipping additional classpath requirements of bouncycastle fips classes * B-D on junit5 * Updating versioned B-D on libapacheds-java * Updating the list of POM files * Patching out more tests requiring unpackaged org.testcontainers Checksums-Sha1: fdda50dc16ad0ebca9064843ec79c839be99f44f 2761 libmina-sshd-java_2.19.0-1.dsc a5f09c97764622567fc5561ba4bab7610ea0934b 1919839 libmina-sshd-java_2.19.0.or= ig.tar.gz a895f43207b114e40e4d4d693a92ecd962e2addd 11388 libmina-sshd-java_2.19.0-1.de= bian.tar.xz d18619fbe1f003153ea40ea1da9839e3d4d702ca 18200 libmina-sshd-java_2.19.0-1_am= d64.buildinfo Checksums-Sha256: 602593801804ce36d7328c0efcca2f6347b92543dd323f8f9b3421a8c719541e 2761 libmin= a-sshd-java_2.19.0-1.dsc fb424c1719fa3db871a9fe1b31b5a60c3fc0d07f75c745c0b654984b5e5f2d14 1919839 lib= mina-sshd-java_2.19.0.orig.tar.gz 6804586eecc733edb3fc17751c3ee2c8d1a42e113a9290ada8eda83e0bc3b80f 11388 libmi= na-sshd-java_2.19.0-1.debian.tar.xz 43e21472480cd27dd2175e1530d16c985fea8b689016ca96af29c598c19be03a 18200 libmi= na-sshd-java_2.19.0-1_amd64.buildinfo Files: 8963d23f4a079fea435dda304336b095 2761 java optional libmina-sshd-java_2.19.0= -1.dsc 9647e589ed971c68454a60e89e77084f 1919839 java optional libmina-sshd-java_2.1= 9.0.orig.tar.gz 1150d33bae0c4d4d4c0d8ab568e2e630 11388 java optional libmina-sshd-java_2.19.= 0-1.debian.tar.xz 47d0f600dfa92dd39f854163fc54fcb4 18200 java optional libmina-sshd-java_2.19.= 0-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmrrmLsACgkQYAMWptwn dHbFuhAAsL/Q26UiVsx5Kj3vCRwU1uq+XcaUyttCuekbNgHVky6KnrvpVdf0Ek/G vIM5GU5hamY1SDWLOjNhuKSW2jNmCkbufaRfDFgS+co1qhRzN0s2JL88l1MT+vkj KqqHhG+1cT2DITeHKkVSvtE+zqTYOPreYmEyl1J/3rVO+gkxBf8sVYXpSlUgc7QY hfV8Ad+gJncnaPP+GRmOOgCsLLic5NxdLmKi0ysyPGVYIptR3tM4YoN4mnv8FwS/ +tMSDKWMo1sp7F11Fx4J4NPm0/AKyr1i66EwTmlDxzDrIduW5ucN+AtxiLvEC6Yi ITlHhGmrjCWPtj4oW8ScAURj1t3U1HbxDfL5UAW6o/jWPoTL5QF1DJVJUvOkifcc dQykDOw6BxdcLA4n3tLQFUz1yYZ07zpt7dgQTt30HO2dPFteTDiEpxx53ihyp4UT OPcbGWIXL+4DP/K87uofTKzJxZ6n1MLqMH0yDuZ/elfBQsG81619keQku6YxTMFf 6cbL/kJYbw+Y2gsEKOtAJSJeMfkK2rdORIjcMV3KT2rrahHZ365ey0C4Qzu6Gcr7 B0vqRVHP3G8FaNnPqHEAyM+WhXHrJNyvWG9xO3r05qqlQ9ZtfUn7MVRXXnsILo02 xuDuU9QSS81zUWMjuzjTa3g9ZYN0fTa+ze8HlogrfveYE0HIwu8=3D =3DQnTG -----END PGP SIGNATURE----- --===============3980696583357120749== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCauuewAAKCRCb9qggYcy5 IYg1AQClF1VV6ofISc+Oi5qegU+/Aied76kU5ZO8lf+IrSuefQEAybGF1yRUGv/w Xhike6RNV4RHPXrc1OV21GLO/DJTAg0= =8Vg5 -----END PGP SIGNATURE----- --===============3980696583357120749==-- ]