[From nobody Sun Aug 16 17:35:04 2026 Received: (at 1144539-close) by bugs.debian.org; 16 Aug 2026 16:34:00 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 111; hammy, 150; neutral, 186; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:41960) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wvdo6-00AGLc-2S for 1144539-close@bugs.debian.org; Sun, 16 Aug 2026 16:34:00 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wvdo3-009wGL-2e for 1144539-close@bugs.debian.org; Sun, 16 Aug 2026 16:33:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=Z0wDm8Toel2JTGrhgZmI5fMtkDsOLEcW3mozhjiH46o=; b=mjIiJJIYWUa4maQcE6YqCJiFx5 /T2PsckV9jczJa3Uxw/2BWFojzIbF7Tjkf3WhjPGQEODCEFJYPszeXKxS6Sk12OT8YQseg1MR8Dh+ peVUnEhSKb4enrM7SyIDyYYTkdkzB8kikPeTyHIUijkBA8BOfo5ihRtH6EVVoaJxCZQKq69MymkcZ 59/VXOxiXCsQvZosWJeLJdZHuQDhapGUfy8L1xt75Ez0Gjkp95Q0baRbw8H+uQps3QrY1o5+wWW0D CCNx7cDcWUb2VR2r1F1xXhSbOpV7rI1tADdX2cRt7R4wu8k5kjY2kdZmMOIxmXJ3VDWTyigFxwFdk LjUiWlkg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wvdo2-0000000BO7j-2eKg; Sun, 16 Aug 2026 16:33:54 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: gregor herrmann <gregoa@debian.org> To: 1144539-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libnet-oauth-perl Debian: DAK Debian-Changes: libnet-oauth-perl_0.32-1_source.changes Debian-Source: libnet-oauth-perl Debian-Version: 0.32-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144539: fixed in libnet-oauth-perl 0.32-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3089231325282406416==" Message-Id: <E1wvdo2-0000000BO7j-2eKg@fasolo.debian.org> Date: Sun, 16 Aug 2026 16:33:54 +0000 --===============3089231325282406416== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libnet-oauth-perl Source-Version: 0.32-1 Done: gregor herrmann <gregoa@debian.org> We believe that the bug you reported is fixed in the latest version of libnet-oauth-perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144539@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. gregor herrmann <gregoa@debian.org> (supplier of updated libnet-oauth-perl pa= ckage) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 16 Aug 2026 17:54:05 +0200 Source: libnet-oauth-perl Architecture: source Version: 0.32-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1144539 Changes: libnet-oauth-perl (0.32-1) unstable; urgency=3Dmedium . * Import upstream version 0.32. - Net::OAuth::Client no longer allows silent downgrades from OAuth 1.0a to 1.0 when the remote provider drops the oauth_verifier. The behavior can be re-enabled with the allow_v1a_downgrade option. CVE-2026-72887 - The Net::OAuth smart_require function no longer memoizes failures, which allowed attackers to exhaust memory with requests for invalid signature methods. CVE-2026-72888 (Closes: #1144539) * Update upstream email addresses. * The upstream examples are gone. * Install new CONTRIBUTING.md file. * Drop 0001-Pin-PKCS-1-v1.5-padding-and-SHA-1-for-RSA-SHA1-signa.patch which was taken from upstream Git. * Update dependencies. Checksums-Sha1: ed259c19131920ffde84542d82b1cfe40666d50c 2646 libnet-oauth-perl_0.32-1.dsc 4c8cfa90d058f0ce99ac4bdc20882eb319bea9eb 32274 libnet-oauth-perl_0.32.orig.t= ar.gz 7d8c5154f7a30505fe555bf9721e54a31da3fea5 4428 libnet-oauth-perl_0.32-1.debia= n.tar.xz 0ecc7a5044b660b2051408cd5a9876a2c3ef1650 106176 libnet-oauth-perl_0.32-1.git= .tar.xz 070168cba2128976ad29beed8a2a60084dd2d9a7 17588 libnet-oauth-perl_0.32-1_sour= ce.buildinfo Checksums-Sha256: 3d45f2a2ffcc3f8c02c0ab25178a390a7653897e8ec8c78478c8d6e78b673fd1 2646 libnet= -oauth-perl_0.32-1.dsc 163180cf34b03bba31372d5f4cae24d382c41ab828abf34cafad7d9b5727a74a 32274 libne= t-oauth-perl_0.32.orig.tar.gz b39719e9e76a0e6fc87adfd889b8315847c0f7d8ee3ca8182aeb6fe07c5009f8 4428 libnet= -oauth-perl_0.32-1.debian.tar.xz 4c77f2ba87162bfd79ce1d6d675ee3945c8762c513e22460084660cd62c2011a 106176 libn= et-oauth-perl_0.32-1.git.tar.xz 76d3712cef45e488913cca564344e5a0265f3348623cc92da1be42eeb9803c1d 17588 libne= t-oauth-perl_0.32-1_source.buildinfo Files: 2ecd9eb3a191c71c5e4a319b30abd05b 2646 perl optional libnet-oauth-perl_0.32-1= .dsc be08a8e9a6ac5c86d0c9cd521980d07d 32274 perl optional libnet-oauth-perl_0.32.= orig.tar.gz 1b9c1a8af5a643a4d5b7e26ec21b6094 4428 perl optional libnet-oauth-perl_0.32-1= .debian.tar.xz 13547fe2bed1eafe2cbec1481ff2c032 106176 perl None libnet-oauth-perl_0.32-1.g= it.tar.xz c7f553c36af8118fc95ba934a8258c76 17588 perl optional libnet-oauth-perl_0.32-= 1_source.buildinfo Git-Tag-Info: tag=3De7955ba346336f104f53741bf939df2a18539fd6 fp=3Dd1e1316e93a= 760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqB3jgACgkQYG0ITkaD wHkcDQ//b6Lz6WWz7dAbih9cUodYRoymttt8GiS+0K6mPepJM8tsHTRhsX+DdC57 QOFTFg2HlgR/xraIhSSJiZr3tqQmojJ3CO78xU2mcFztATtTeQZaWKFCzhvKpg9k zxnoNXOlTp8o//gYodubtXAZ+FQhR5LstPF+ZVkSJlE1y3ViswEzeid6ZfTlXRzH VD8kqp9659E7Uxc1kJr73qys9cHYF86Ix38H75MzFRaowz273+L7dYMyitVVnTCm EEIQ/5Pxwf9jqUCYWbyuy0V6fSc0abUh49Qp4AO4+hNTnReMCd+QnI406233lTVD nh5IRDmnu41zcgt3dLvRPxrPlwC65R4zOj9iSmwPfI9QKYXb3YQR7WnWCXVXMQ1X QEpRCQQPhY+U0lo6zRv+r2BueArmbD4dAywhbaPlSkdwpNERYRg6BwrJIaTZ/Ogd mOjzeRKghHwVCZG4yO5JEQ/EhA4iv8BXpPxZTn2Xm7uwCsjAHaJI2OeFiszSt7Bi eRvKwdTXddmYQDRlnealzzaJ+3B2rgDNAuI1isDUcCRLSBk6TUzVFB2glySW2Uzz ZaIHaIYEOk+TsgKoy5HH8tMxyfZf143pGa2idoHkXQH7Ec4gkBBP9XDiIW0n9OQA jZci/KUenJ0wPcyQkCwS7t7K3hbVJTVlD8fo/PEfwsNpmFiihLM=3D =3DMTBO -----END PGP SIGNATURE----- --===============3089231325282406416== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaoHmcgAKCRCb9qggYcy5 IcxyAQCLf20n5qocwa2yiZMzH31w3Vfmv8UAM++1dZEDegPi9gEAhmt1nScpYnwR w1xXWSnkejiLvGM1xqm1D3J58mtx4gY= =Ube9 -----END PGP SIGNATURE----- --===============3089231325282406416==-- ]