[Pkg-erlang-devel] erlang-hex_2.5.3-1_source.changes ACCEPTED into experimental

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 17 Oct 2026 00:17:11 +0300
Source: erlang-hex
Architecture: source
Version: 2.5.3-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Erlang Packagers <pkg-erlang-devel at lists.alioth.debian.org>
Changed-By: Sergei Golovan <sgolovan at debian.org>
Closes: 1150902
Changes:
 erlang-hex (2.5.3-1) experimental; urgency=medium
 .
   * Team upload.
   * New upstream release.
     - Fix CVE-2026-105274: Improper Handling of Highly Compressed Data
       (Data Amplification) vulnerability in hexpm hex_core allows
       an untrusted repository mirror, or a server answering hex_core's
       API requests, to exhaust the memory of the Erlang VM running hex_core.
       The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and
       rebar3 (r3_hex_repo, r3_hex_api). Closes: #1150902.
     - Fix CVE-2026-103503: Improper Certificate Validation vulnerability
       in hexpm hex allows an attacker who can intercept HTTPS connections,
       and holds a certificate for a Hex host issued by a CA in Hex's bundled
       CA store, to impersonate that host to users who set cacerts_path to
       a CA store that leaves that CA out.
     - Fix CVE-2026-105280: Improper Validation of Integrity Check Value
       vulnerability in hexpm hex allows a package mirror to substitute
       the tarball that mix hex.package fetch PACKAGE VERSION --output -
       writes to standard output.
     - Fix CVE-2026-105668: Protection Mechanism Failure vulnerability
       in hexpm hex allows the owner of a package, or an attacker who has
       taken over the owner's account, to get a newly published release past
       the release-age cooldown.
     - Fix CVE-2026-96618: Improper Handling of Highly Compressed Data
       (Data Amplification) vulnerability in hexpm hex allows an untrusted
       package mirror to exhaust the memory or disk space of the machine
       running mix deps.get, mix deps.update, mix hex.package fetch or
       mix hex.docs fetch.
     - Fix CVE-2026-96612: Improper Limitation of a Pathname to a Restricted
       Directory ('Path Traversal') vulnerability in hexpm hex allows
       a malicious package publisher to delete a directory outside
       the project's deps directory and extract package files into it when
       a developer fetches dependencies.
     - Fix CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control
       Sequences vulnerability in hexpm hex allows a malicious package
       publisher or a hostile repository server to inject terminal control
       sequences into the output of Mix tasks.
   * Bump debhelper compatibility level to 14.
Checksums-Sha1:
 f836776718bf25c94698363e2f766367b2aff788 1936 erlang-hex_2.5.3-1.dsc
 b4e7b7a0961d1098607980f4e100f6a5762c245d 610397 erlang-hex_2.5.3.orig.tar.gz
 8055e9d5c234a33196cbc4cb0a346d402ab6e857 3976 erlang-hex_2.5.3-1.debian.tar.xz
 43716abf0ec50a7213d1a6605cce671b2bc48620 6064 erlang-hex_2.5.3-1_amd64.buildinfo
Checksums-Sha256:
 4068b4079702d808f078fcf2d6ffb9c246ba37ae0c53f4c7930b7e5ced3236a8 1936 erlang-hex_2.5.3-1.dsc
 763398d6aa2a3a969d156b1ff74ff59f4be36484023b3e0a25fae524ed0f2213 610397 erlang-hex_2.5.3.orig.tar.gz
 c9ec95697a80d246f5fbe0f2d8aea10cbe3052fa4ba70e23ef0bb8ee0c1681f7 3976 erlang-hex_2.5.3-1.debian.tar.xz
 0598f9c7c6b72ab3940da1cd335c80354a1c94c2c65d0379cb78532aa209c59d 6064 erlang-hex_2.5.3-1_amd64.buildinfo
Files:
 fd94f32a638e9e2b220e9f09a282c157 1936 interpreters optional erlang-hex_2.5.3-1.dsc
 328389e56811a8d94c58712318fa8555 610397 interpreters optional erlang-hex_2.5.3.orig.tar.gz
 1fe919b3d464e08af06eb333451dfe7f 3976 interpreters optional erlang-hex_2.5.3-1.debian.tar.xz
 927b58942e87080cad64718fe7159e7b 6064 interpreters optional erlang-hex_2.5.3-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmrSlVUACgkQTyrk60tj
54ec2xAAmFgYKC101BI8hTKKiItI/HTVAyYOajCUKvoz+2S49ZiA4oUcuUhwV0ND
fhD58va2g1pyEA0gc2IEjBDhDU1YcIuyym/ndC+i8ZCAR/rqHEmxF4jAv5WOPVRt
mgK+34ACt8Bevo13pKWn7bnFm4Zihh6f7mR/k2132sfKlb+Vci9EJkHX1sMsG5RD
B2XF+FUstiRCfWg81PEaK9h9Pli8lvjns2XV4olHSCepQLOWwqXkiZnWEIymxbbK
QdY7dW7LmLysGT3WGkFDttaxCbdOpBUmid7x82zFgEEG7Bd12F3PEeIRlUf2f/zA
tdhGXPpboH4R0TrLjiYxwGjGrjEFj2CBuUrAFqH3LdmkojGNWaRhSqKYnCtKiLiT
PE4CJUAaS7/EqQR+qU9Boj0Hv1LEsn/3iZwzOsePvJqaXq9eXEVmKMcXXND5JecT
fMZp8FrDe4H8tPgA+GkvwoQ82W9BjB+hVT+/QIqYLcyWBWxciqLFCodHukGHcN0e
XMv/qN+eZ0nJoUYAlDi0d+4z570HiY7IBmBk4Y4s0/jTl1arEKPype8S5x6Zyaze
JF+owbVOMemlsopE3mTuTBRbJi70Oa8mbzvdKrJLRNwjySu5oSlAvFdniw5cYEde
ZtAlvPC6RKqRucTopav1KMGvaFl3R56DFJAJkHdzE9r1nY1/hbE=
=psWe
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-erlang-devel/attachments/20261016/5d384533/attachment.sig>