[From nobody Thu Aug 20 20:53:04 2026 Received: (at 1144283-close) by bugs.debian.org; 20 Aug 2026 19:51:20 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.7 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PDS_BTC_ID,PGPSIGNATURE,SPF_HELO_PASS, SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 98; hammy, 150; neutral, 164; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:35860) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wx8nI-006YUm-1t for 1144283-close@bugs.debian.org; Thu, 20 Aug 2026 19:51:20 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wx8nH-00ERWK-17 for 1144283-close@bugs.debian.org; Thu, 20 Aug 2026 19:51:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=t3SFJH1PXeQ4mxtrkzikql1XC3jcevpdIMxwmYPPWgI=; b=YFiMTHmLJEiYg6FiQ3pfCepM+y 7NPmTiXMknDkJj9QiiziAmD175fxgG2sS7coGCloqN8Yyvx3GoJ9QjMV3NvwCZBdXMgLe/1mlbNZQ kgch0KoZDWg1GL297eXPqIeYwVBA4/4vaCXrLerZRQi0wTTtZSC0di2E0PjBd9f2WgQfnTjb89JhX 1Wm/VmJomHGOCXG79IR19k8ItTZr/Q6oJZ2DoYUWPdG+9s+8xB3ILESFlaH9/pDCRSSLMcWCVVcG3 sxGtChsAfh/bvpQJ1Lo8RL8o3mkeLSdwe1LcCLmbUd2nAteWjbvdjJjEAFD+h5qg06qCZDrDf7Ukg qW7s/lxQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wx8nG-0000000Blgr-1zdy; Thu, 20 Aug 2026 19:51:18 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1144283-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: ostree Debian: DAK Debian-Changes: ostree_2026.4-1_source.changes Debian-Source: ostree Debian-Version: 2026.4-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144283: fixed in ostree 2026.4-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8504524159328397731==" Message-Id: <E1wx8nG-0000000Blgr-1zdy@fasolo.debian.org> Date: Thu, 20 Aug 2026 19:51:18 +0000 --===============8504524159328397731== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: ostree Source-Version: 2026.4-1 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of ostree, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144283@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated ostree package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 20 Aug 2026 20:16:44 +0100 Source: ostree Architecture: source Version: 2026.4-1 Distribution: unstable Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1144283 Changes: ostree (2026.4-1) unstable; urgency=3Dmedium . * New upstream release - Fix regression when downloading large Flatpak apps/runtimes (reopens: #1144105) (Closes: #1144283) * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch: Add post-release patch to fix offset validation. This was an out-of-bounds read when downloading from a malicious/crafted ostree repository, but is not believed to be practically exploitable for anything worse than a crash (denial-of-service). * Mention #1144105, #1144106 in previous changelog entry Checksums-Sha1: 07c6c9a404da2898f100a5759e3a6699c928f2c8 3659 ostree_2026.4-1.dsc be31484d5c00353b6c3d966750c83eb44a8a53d0 2141564 ostree_2026.4.orig.tar.xz 12b48ff7d96c87988c7876e2091b92a61c961927 32388 ostree_2026.4-1.debian.tar.xz c92fa07d27f72b9b4447340ff03c6c141cd597f9 4404808 ostree_2026.4-1.git.tar.xz eaec49b59524ecf5d5b322673d96a740bbccf948 17660 ostree_2026.4-1_source.buildi= nfo Checksums-Sha256: fe860de2bd97e6cb51964238cab33b680905edaeed3d5dd21b813e71c3fe19f8 3659 ostree= _2026.4-1.dsc b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7 2141564 ost= ree_2026.4.orig.tar.xz 88138ea5ab0c0a8dfa5e0eea991ef308e5f70b44f3b2ce10f4bf6c93e1d35d38 32388 ostre= e_2026.4-1.debian.tar.xz 82c6e8eacbc3d6a9f15cd566dd667acf455dd6a5cc12790efdb9bdf6bf2af954 4404808 ost= ree_2026.4-1.git.tar.xz ffdb7973926bf001b20ce5dca311bf10ce007023652c8d41b8ab08d1d309132d 17660 ostre= e_2026.4-1_source.buildinfo Files: f23b4b366843ad133268cf2091b81d6f 3659 admin optional ostree_2026.4-1.dsc 22d3422529c07eef716fea8a6c9b0c2b 2141564 admin optional ostree_2026.4.orig.t= ar.xz d880d033e7125ecb69e7b8e8fbb6522d 32388 admin optional ostree_2026.4-1.debian= .tar.xz 7389dee2cf3f871f1e2fb656b786791b 4404808 admin None ostree_2026.4-1.git.tar.= xz 17d23b44b3169c15b74c4b36172498ba 17660 admin optional ostree_2026.4-1_source= .buildinfo Git-Tag-Info: tag=3D5b299e2d91e6d04ca690a674004237f6127aa26f fp=3D7a073ad1ae6= 94fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqHVmMACgkQYG0ITkaD wHnBgQ//Q9BXJf4onNGDNZb1LxLc1HQob5wDZ0gN23VuSr5qX1cbxaIO0+AO/d+j Ngl5zWr4cuuSjHcVCwHcrx35Oss5zY6A8COOkqq8UIoVRK6mzsPh4hXqTuMw1rEX f6uqN0MgXfT0Z4/CSvFC4csWjCYqerFGEe1ZgONUzULulIlWPXkPsXQlUBR4G7NY SXZ+beXI2yDGmbqfbMLPogLaG63k7dmkfggbu1UxRfOECu9jntkJyQiDyb/tdYRZ l++ss9T/HMPti2q5RXb1bljRP9db+Nu3cZqJYhyo3EVRk34D7SxDUMa3MDtvzM2Q zrOfKQAOaNoXMbsw6u8wyF8yT3xqTzYd8OtB7jyQKF1bMM13aXNLVNEW23RxCAot 8fdkD2ajtr1TeCv4MNbiICeNw+9i0+G2b4xE7pT7k4F0K4hWEiCtlI47goKVmtZW /2HsNetjPc7d+Ze+Ohv9Emp1HSh+lw5zzW6NHOXUTU5vdMYHO52voiNYZeUtYuLX wZt7+XJNLFkD6EqPETM5QtFtCSK2tVJkYAlF1mEYFk/IQjh0azXsbAso2dwMRQV4 vhl6Oeb+el4DyMDk4AkUcaTo57Szj+k2+Db7sClUpnkPJ93asbEfwv9hAHRYW5Kv XGhWwqyjbIAxcl6poV/Lev2CrQQIdhZnPGwVvzqjziKYXO/Cef0=3D =3DnvHM -----END PGP SIGNATURE----- --===============8504524159328397731== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaodatgAKCRCb9qggYcy5 IQ8BAQD6vePKKyfPygn0/qfPZ1Kagi3erW2winhL1p9gzed+fgD+JBa9cZliyGkY i3gvSGhMQRurTYMi468Uxiy+m3HX/AU= =Iyrz -----END PGP SIGNATURE----- --===============8504524159328397731==-- ]