From noreply at release.debian.org  Thu Jul  2 05:39:33 2026
From: noreply at release.debian.org (Debian testing autoremoval watch)
Date: Thu, 02 Jul 2026 04:39:33 +0000
Subject: [Pkg-freeipa-devel] custodia is marked for autoremoval from testing
Message-ID: <E1wf9D3-004g3b-2s@respighi.debian.org>

custodia 0.6.0-5.2 is marked for autoremoval from testing on 2026-07-30

It (build-)depends on packages with these RC bugs:
1138813: sphinx-gallery: <!nodoc> build dependency removed from testing
 https://bugs.debian.org/1138813



For more information on the autoremoval process, including hints to prevent
autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval

This mail is generated by:
https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl

Autoremoval data is generated by:
https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl


From ujjwal.sarswat at canonical.com  Fri Jul 10 06:12:01 2026
From: ujjwal.sarswat at canonical.com (Ujjwal Sarswat)
Date: Fri, 10 Jul 2026 10:42:01 +0530
Subject: [Pkg-freeipa-devel] Bug#1137385:
References: <20260523131728.mS3rmpPI@breakpoint.cc>
Message-ID: <CAKv0x7UEc9WR+04SFYd+BJ305tCXqX_HRyWFNJK+JjD0+frdAw@mail.gmail.com>

This is an issue in the openssl-sys crate and has been fixed upsteam in the
crate[1].
This has trickled down to this package as well. A simple update will fix it
and a patch is
not necessary, unless some other OpenSSL 4.0 related complication arises.

[1]
https://github.com/rust-openssl/rust-openssl/commit/1fc51efa3f63e38a3139e201edf3395e5a10f8ba
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-freeipa-devel/attachments/20260710/36025af3/attachment.htm>

From debian-bts-link at lists.debian.org  Mon Jul 13 18:33:23 2026
From: debian-bts-link at lists.debian.org (debian-bts-link at lists.debian.org)
Date: Mon, 13 Jul 2026 17:33:23 +0000
Subject: [Pkg-freeipa-devel] [bts-link] source package src:freeipa
Message-ID: <178396400393.1206515.14786399522498933730.btslink@sonntag.debian.org>

#
# bts-link upstream status pull for source package src:freeipa
# see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
#     https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-link at lists.debian.org

# remote status report for #795399 (http://bugs.debian.org/795399)
# Bug title: freeipa: CVE-2015-5179: non-printable characters aren't check in every case of user data
#  * https://pagure.io/freeipa/issue/5153
#  * remote status changed: (?) -> Closed
#  * remote resolution changed: (?) -> wontfix
#  * upstream said bug is wontfix
tags 795399 + upstream wontfix
usertags 795399 + status-Closed resolution-wontfix

thanks


From owner at bugs.debian.org  Mon Jul 13 18:35:14 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 13 Jul 2026 17:35:14 +0000
Subject: [Pkg-freeipa-devel] Processed: [bts-link] source package src:freeipa
References: <178396400393.1206515.14786399522498933730.btslink@sonntag.debian.org>
Message-ID: <handler.s.C.17839640081585670.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> #
> # bts-link upstream status pull for source package src:freeipa
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
> #     https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-link at lists.debian.org
Setting user to debian-bts-link at lists.debian.org (was debian-bts-link at lists.debian.org).
> # remote status report for #795399 (http://bugs.debian.org/795399)
> # Bug title: freeipa: CVE-2015-5179: non-printable characters aren't check in every case of user data
> #  * https://pagure.io/freeipa/issue/5153
> #  * remote status changed: (?) -> Closed
> #  * remote resolution changed: (?) -> wontfix
> #  * upstream said bug is wontfix
> tags 795399 + upstream wontfix
Bug #795399 [src:freeipa] freeipa: CVE-2015-5179: non-printable characters aren't check in every case of user data
Added tag(s) wontfix.
> usertags 795399 + status-Closed resolution-wontfix
There were no usertags set.
Usertags are now: status-Closed resolution-wontfix.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
795399: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795399
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From carnil at debian.org  Fri Jul 17 07:50:11 2026
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Fri, 17 Jul 2026 08:50:11 +0200
Subject: [Pkg-freeipa-devel] Bug#1142285: 389-ds-base: CVE-2026-11610
 CVE-2026-14940 CVE-2026-14969 CVE-2026-15041
Message-ID: <178427101196.486135.4476638906266368658.reportbug@eldamar.lan>

Source: 389-ds-base
Version: 3.1.2+vendor1-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for 389-ds-base.

We will need some help from you to identify the proper upstream fixes
for this set of CVEs. Thanks already.

CVE-2026-11610[0]:
| A heap buffer overflow flaw was found in the SASL I/O layer of 389
| Directory Server (389-ds-base). After a successful SASL bind with
| integrity protection (SSF > 0), an authenticated attacker can send a
| specially crafted oversized LDAP UNBIND packet that is copied into a
| 512-byte heap receive buffer without a bounds check in
| sasl_io_recv() in sasl_io.c. This allows up to approximately 2
| megabytes of attacker-controlled data to overflow the buffer,
| causing a denial of service (server crash). In FreeIPA and Red Hat
| Identity Management deployments, any domain user with a valid
| Kerberos ticket, any enrolled host, or any service account can
| trigger this vulnerability over the network after authenticating via
| GSSAPI. The vulnerable code path has existed since approximately
| 2013 (389-ds-base 1.3.2) and was not addressed by the CVE-2025-14905
| fix, which patched a separate heap overflow in schema.c only.


CVE-2026-14940[1]:
| A heap-buffer-overflow flaw was found in 389 Directory Server
| (389-ds-base). When normalizing a Distinguished Name (DN) that
| contains a legacy-quoted value encoding a multivalued nested
| Relative Distinguished Name (RDN), the server can write past the end
| of a heap allocation while sorting RDN attribute-value pairs. An
| unauthenticated remote attacker can trigger this condition by
| sending an LDAP operation whose DN reaches the DN normalization
| routine, such as a search with a crafted base DN. This can corrupt
| heap memory and may cause denial of service.


CVE-2026-14969[2]:
| A flaw was found in 389-ds-base where the LDBM backend attribute
| encryption uses a hardcoded static initialization vector for AES-CBC
| and 3DES-CBC operations, allowing an attacker with privileged
| filesystem access to detect plaintext equality across encrypted
| entries by comparing ciphertext blocks.


CVE-2026-15041[3]:
| A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password
| verification function uses standard memcmp() for comparing password
| hashes instead of a constant-time comparison function. A remote
| attacker could potentially use timing measurements of LDAP bind
| attempts to infer partial hash information, though practical
| exploitation is extremely difficult due to PBKDF2 computational
| overhead.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-11610
    https://www.cve.org/CVERecord?id=CVE-2026-11610
[1] https://security-tracker.debian.org/tracker/CVE-2026-14940
    https://www.cve.org/CVERecord?id=CVE-2026-14940
[2] https://security-tracker.debian.org/tracker/CVE-2026-14969
    https://www.cve.org/CVERecord?id=CVE-2026-14969
[3] https://security-tracker.debian.org/tracker/CVE-2026-15041
    https://www.cve.org/CVERecord?id=CVE-2026-15041

Regards,
Salvatore


