[From nobody Sun Jun 21 20:19:08 2026 Received: (at 1138050-close) by bugs.debian.org; 21 Jun 2026 19:17:28 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 77; hammy, 150; neutral, 135; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:53036) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wbNfc-00DCfI-1R for 1138050-close@bugs.debian.org; Sun, 21 Jun 2026 19:17:28 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wbNfc-0072HM-1C for 1138050-close@bugs.debian.org; Sun, 21 Jun 2026 19:17:28 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=+WMbkrz2AvENJAb3XE1AOATTpN1j5AEPonc7p6CRJdE=; b=hV2Br7s1IPeARwaC+NLiunkgL8 wrKYSwxhPhut7/gUfwurH2JVIprWndsRT+UjwO+p5SqdFO1IhAls6hk9gUSsBIrSOGAZOw6oeI1Gx ppp31EhZDw2V6NgOHIpkr0MpbjpQQerFzFKuYhmCKEXMZQq/I7zmvSXTIUXn2X6NcYlDFCQYD33RU RounhXJJ7cA3Z391iPUi+n+j2h96t44dUUDX8QNIcpBT6F2uWFKJYq8qX5MvQao7todKV5IpEQI6J cymq+Z91w2aAsnAgLV8vmA+4AKovcZHAwERdr84WVqlbICUAaNK4DHln4FpwkTA/woTAjycfCHyyp 5ehpEHIA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wbNfb-00000004r54-2FI5; Sun, 21 Jun 2026 19:17:27 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Salvatore Bonaccorso <carnil@debian.org> To: 1138050-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: libhttp-daemon-perl Debian: DAK Debian-Changes: libhttp-daemon-perl_6.16-1+deb13u1_sourceonly.changes Debian-Source: libhttp-daemon-perl Debian-Version: 6.16-1+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1138050: fixed in libhttp-daemon-perl 6.16-1+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============2932188858006471065==" Message-Id: <E1wbNfb-00000004r54-2FI5@fasolo.debian.org> Date: Sun, 21 Jun 2026 19:17:27 +0000 --===============2932188858006471065== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libhttp-daemon-perl Source-Version: 6.16-1+deb13u1 Done: Salvatore Bonaccorso <carnil@debian.org> We believe that the bug you reported is fixed in the latest version of libhttp-daemon-perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1138050@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libhttp-daemon-= perl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 20 Jun 2026 23:14:47 +0200 Source: libhttp-daemon-perl Architecture: source Version: 6.16-1+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1138050 Changes: libhttp-daemon-perl (6.16-1+deb13u1) trixie-security; urgency=3Dhigh . * Team upload. * Fix CVE-2026-8450: send_file() honoured 2-arg open() shell-magic (Closes: #1138050) * Add regression test for send_file() shell-magic refusal Checksums-Sha1:=20 2988076bfca1f8e9c82118874335aab3b43288f0 2609 libhttp-daemon-perl_6.16-1+deb= 13u1.dsc cf817337ec9f4bb2c7f2e46b9762b3d8234f68a0 45830 libhttp-daemon-perl_6.16.orig= .tar.gz 33e9ef6c87d48d84af5323ad3710eb42862af693 7840 libhttp-daemon-perl_6.16-1+deb= 13u1.debian.tar.xz Checksums-Sha256:=20 b899360a4ac3e26d39859fbc6b983953f4394da4b41b9f28823371eb12d32b77 2609 libhtt= p-daemon-perl_6.16-1+deb13u1.dsc b38d092725e6fa4e0c4dc2a47e157070491bafa0dbe16c78a358e806aa7e173d 45830 libht= tp-daemon-perl_6.16.orig.tar.gz 6b6ec08c19e4a27f863165928dfd17fe02306c328929481bfdb72e4cb9e02922 7840 libhtt= p-daemon-perl_6.16-1+deb13u1.debian.tar.xz Files:=20 08394088eb1492889422d136fd983d02 2609 perl optional libhttp-daemon-perl_6.16= -1+deb13u1.dsc 51425462790165aeafc2819a7359706f 45830 perl optional libhttp-daemon-perl_6.1= 6.orig.tar.gz 6c3789c087d35fb25b59b6ce92b3ce33 7840 perl optional libhttp-daemon-perl_6.16= -1+deb13u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmo3Cg5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EJ7wP+wfz2mYt/W7mXVl09dDqMxvvs8rvVSet 0xnpdU6U5cEr3JMFPBNCg4YqaKKgjkKa9gj5LtNBSf7uJ0LvymzLxKfCkHAETQ/g UimVAOn690wiSamkAoNnF0lFCaK63LO65zoadknmOq7tZ9qVo4ilTufvm7imuS75 vD9AXdF5FXFjg5GTA4h3+kxE9qOxTNpjEZ3VbX6D/r3gwE/8WyOj0G8YRtIglPZL 1jFcqTotyfcPM8VkbOlEjY8cSkGwSJwNShtA5F8O4V1Mdqa1I3iq0iISbFuajDx1 qHA7OlO6HWxpihlIWwGrrTB6T5yaTQcxvySoB06oFnXySCR9gK/eschIjGGMhOh3 Kk+hbNFQA/gss0mAM1ZT2L5bnYGtSL+27Lv9p+qFf8YrH0ujZLoIiT6gEkzhVhqe xqXyGWB6sviN4ZgnWmXq+UxZvRX8p26TRiNtkG5VZ6OuenltlA72W1jutb/c1hRw 3S76HHFgL4oluIG/NzinEdZJbU89pgoIDS86UD/BBFhnKSZeaZd9YrD2vi3ZZw8K bwvqVgU4G/pyCrkJJejbkuI4cVFwD91NO9eNLiURbBQKj6o6PAqua0HdqBQyjIOe grkxukbHlWRBZPXFTEafjLdj2tLLlvpoFn/d83F2KgbNgJPLf6kXvnTme/ATUYLD /Pcb8BBmWfsj =3DqtYP -----END PGP SIGNATURE----- --===============2932188858006471065== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCajg4xwAKCRCb9qggYcy5 IQFAAQCrhUUILs7eXdNqTT7IN5uMoL6vgB5caBH5nNU/n5ne1wD9H9lyIQxnfZPM 1fyd90roBt2lV3T1htMqhVIfn8lZmAA= =TNMJ -----END PGP SIGNATURE----- --===============2932188858006471065==-- ]