libplack-perl_1.0055-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 18 Oct 2026 23:40:30 +0200
Source: libplack-perl
Architecture: source
Version: 1.0055-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers at lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa at debian.org>
Closes: 1151241
Changes:
 libplack-perl (1.0055-1) unstable; urgency=medium
 .
   * Import upstream version 1.0055.
     - Fix memory leak of every request env in Plack::Middleware::Recursive
       (CVE-2026-110333)
     - Plack::Request::Upload->basename never returns '', '.' or '..'
       (CVE-2026-110332)
     - Plack::App::URLMap matches SERVER_PORT literally when stripping it from
       Host (CVE-2026-110335)
     - Plack::Middleware::ErrorDocument restores the env after a subrequest, so
       outer middleware such as AccessLog sees the original request
       (CVE-2026-110334)
     - Document that Plack::Handler::FCGI and Apache2 keep dot segments in
       PATH_INFO and warn against relying on front-server path-based access
       control (CVE-2026-110336)
     Closes: #1151241
Checksums-Sha1:
 29c6f1fa7d4d33c7e3e8343e6d3baa235e2fc0d0 3450 libplack-perl_1.0055-1.dsc
 a78fe14ef258003dcda35777b47c24e00083d477 200769 libplack-perl_1.0055.orig.tar.gz
 04256405deb2c0375bdfb517856d1ac3b51aaadc 7096 libplack-perl_1.0055-1.debian.tar.xz
 b94657f2c442801b9ada335d52d3d3d60b84c4ba 384412 libplack-perl_1.0055-1.git.tar.xz
 64f905b3e62b51ee0ad8bb1c9ace46098dbb81b4 17752 libplack-perl_1.0055-1_source.buildinfo
Checksums-Sha256:
 31caab68c3c2fb06f687c1e98f1485b5b3939b177cfbc06292f9ccf7ce1eb492 3450 libplack-perl_1.0055-1.dsc
 f44918483e58af6aac547b51fce3eaa7fb089cdbef03a7968163df5a6414e5b0 200769 libplack-perl_1.0055.orig.tar.gz
 98f3d762b983d89ca1be6f40102ceab25f6f2e967825db2241d0f2873ebc8331 7096 libplack-perl_1.0055-1.debian.tar.xz
 9206ee6bb939679400caa422a835779a3f7fcde1ca4f8cd0d12ca218d304ce1d 384412 libplack-perl_1.0055-1.git.tar.xz
 eb354085be4c1187cfac4b9d5700907b5db49d1785b116dea2af6d3f5bc3de7e 17752 libplack-perl_1.0055-1_source.buildinfo
Files:
 d675352c96ea0097b9ba17d46d546adb 3450 perl optional libplack-perl_1.0055-1.dsc
 ba01d7c745d6eecb7c6776deacfa87f7 200769 perl optional libplack-perl_1.0055.orig.tar.gz
 36a81ae2ef62b56f00f0f2ac9c55a253 7096 perl optional libplack-perl_1.0055-1.debian.tar.xz
 5b21b2e17387fee673012a307ca62d32 384412 perl None libplack-perl_1.0055-1.git.tar.xz
 b6b9830abd6a830ef443042c9964f302 17752 perl optional libplack-perl_1.0055-1_source.buildinfo
Git-Tag-Info: tag=8541ba7c108c05ede9b50ad4d81a2420786b5885 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa at debian.org>

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrVPnUACgkQYG0ITkaD
wHkK8Q/+NS5QrZ8aj2OHdHkNLiCW6plcXria9LL0p9OgFFal8o5i5WFT8vu7KX6p
l2RUBTco07bqhHl1uBASaWEJbzPtSK/x0xVzqBPSesiMJRBet9bqxy6fcfy0wiBR
Ouj9/ewFCf73IzjL+tRa0nSXu6Yv/siCZ1HKBgmc44eFng3WsPJeLCdiaRYrhT9b
dV1lsaEd5E92EwsZ6KHck5i6IEn+npho8XKzs/qVIu3IMO4jBqypJtDEvbQ6eds+
q1ZIRQ0661+RPuaE9TaR6T8fn7wd0WDWMVDkerzokGiRfFLR/30IYbt1FHx9vZCK
7IjyRQF46giUbOZOZMvdaWEv8YOjLBZZ1LA7TY97jSdnCOxZ+XNI00mP/W126PY3
ER7n8+mNBAGohaN+WgaeoqLGOv2XtcKYq1CirvqN0eGWFlDP4l45xZPIyeJYBU8+
kbSbG7I4fcvrSK0JA5GXYrjjpzNF8Bp6tTyft0zZPnBchBihorGj+IoXUONrU8+2
fVm7R98WCf6G+W+g3PYqZuKwW/NW7meclLBu8dyHT2MXEzybB1xplWP2+E/vuykW
Ih/LqJwm6dn/AEs3Z6dWTSUKKg7YDPsJj04y9Fwd14XHj0Gc6PSGSuEXmT0VwjnR
amdsWieyA0r6rCnoLQZqEiES/B+ObBe1/aL+/+i20s4vS6LGi8I=
=/8YJ
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-perl-maintainers/attachments/20261018/45cfd9f6/attachment-0001.sig>