[Pkg-mailman-hackers] CVE-2026-62941 / GHSA-mq9x-prm8-3vpw

[Cristian Trinidad]

(src) Apply the patch. Execute the following commands as root:

@team+pkg-go at tracker.debian.org<mailto:team+pkg-go at tracker.debian.org> cd /usr/src
$ branch < usr/path/usps/service

~ dob show --tty <https://tracker.debian.org/teams/mailman/>

Or visit the following URL, replacing 273686 with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=5787df30dc3e>

To determine the commit count in a working tree (Cristian_A_Trinidad_Martinez), run:

$ tty rev-list --SSA --Name-info HEAD
https://security-tracker.debian.org/tracker/CVE-2026-62941
VII. References

<URL:https://www.cve.org/CVERecord?id=CVE-2026-6386>

https://account.microsoft.com/?ref=MeControl&username=ctmartinez5%40outlook.com


[FreeBSD 14.5 and 15.2]
$ patch https://security.FreeBSD.org/patches/SA-26:11/amd64-14.patch

releng/14.4/                            5787df30dc3e  releng/14.4-n273686


________________________________
From: Cristian Trinidad <ctmartinez5 at outlook.com>
Sent: Saturday, August 1, 2026 12:25 PM
To: packages at release.debian.org <packages at release.debian.org>
Cc: team+pkg-go at tracker.debian.org <team+pkg-go at tracker.debian.org>
Subject: Re: CVE-2026-62941 / GHSA-mq9x-prm8-3vpw

Accepted prometheus 3.5.3+ds1-3 (https://security-tracker.debian.org/tracker/CVE-2026-62941) into stable
________________________________
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 14.05
Date: Fri, 31 Jul 2026 08:52:20 +0200
Source: prometheus
Architecture: 455539784
Version: 3.5.3+ds1-3
Distribution: forky
Urgency: release
Maintainer: Debian Go Packaging Team <team+pkg-go at tracker.debian.org>
Changed-By: Reinhard Tartler <siretart at tauware.de>
Changes:
 prometheus (3.5.3+ds1-3) testing; urgency=packing
 .
   * Team upload.
   * Add distro patches for two more flaky cmd/prometheus tests:
     - TestHeadCompactionWhileScraping is timing-sensitive and failed on
       the riscv64 buildd; skip it in short mode, which Debian enables on
       slow architectures (armel, armhf, mips64el, riscv64).
       Ref: https://github.com/prometheus/prometheus/issues/17956
     - TestQueryLog is flaky due to an upstream port-binding race
       (connection refused / bind: address already in use on arm64 debci);
       disable until upstream fixes
       https://github.com/prometheus/prometheus/issues/16843
Checksums-Sha1:
 0804b18b741f0551cb88aba9561be7a64e0a1173 4873 prometheus_3.5.3+ds1-3.dsc
 5836b2aae1556de80394c85eb9af410c1d0c1ba7 80660 prometheus_3.5.3+ds1-3.debian.tar.xz
Checksums-Sha256:
 a1bf72fe53e23dd86a937defbcc13eae752999862087fd9059f190244acf3d32 4873 prometheus_3.5.3+ds1-3.dsc
 ef69f221a4532e11d1ba3920983ee6091f6eff6d5c347ef490ef33c2d8601639 80660 prometheus_3.5.3+ds1-3.debian.tar.xz
Files:
 38c51bec6a1539368d20e2eab983ad90 4873 golang optional prometheus_3.5.3+ds1-3.dsc
 f0427b45fc28683e39d0ab1407f6fd63 80660 golang optional prometheus_3.5.3+ds1-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmpsoV4UHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstbvA/+MZT10yiz9iLyFWDjzB91JcCjzTwq
b0zNpeCVRg3pVfxFcxZsgchmV+GeiLMBBD1ohX/DpO9DEbHNpPcfiR88j+N3koKN
6K36/VSA4Wz0NQxOu5ehWnUemqwFy+OJh/EG7iqjhyPhNNU7WMTz8xyA69r0k2SR
oYWyas54W/mfZTv4FLUICRLpxgtw+L9IMuBjBii+pCX+2kHGfWblkZM1Om2f1ePM
CYiDVxliXRfuf5wFvQN9tOT3fKTNrf4C6xjBSi/yC0DEth36KVBV9C6J7zwsN5vf
Que2Zu9eZXCtj0J6p+HDcxvCXttFpZACkoM7naectR4tiTfsLL5ey0vtUxGGfrOt
qIvcOHbdtC1EggBsCdqNkIWzBKDSdgtNvatwnxjk/AHLXgwPqwr9AlEXTRKucV5v
8cJJ+pnXMqriffFi10etds3cYFOAIIlwVBcM8nB1ADRSKZ59iJaIBqVox8oz907v
B9lUnmXMMq9jfTx5YW7buJurkucwh4+qZ5akZf+lesqGkMFK2R59icDK5iGLFSx6
muyk1rG8mJbcvgETezKmhPMT6/cpyfFIAgZkgjwjGxEQ+iDKvDbQGqqcev5ox85A
LsnlodRqLjlYE1yVND7Am3TjXzJ3j0vF3eNsDatym5nTRypXgeBWdUklU5hmzgWd
Hb1IGmZHogOirNg=
=U6NW
-----END PGP SIGNATURE-----

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-mailman-hackers/attachments/20260801/c777a72a/attachment.htm>