[Pkg-privacy-maintainers] Bug#1139716: onionshare - CVEs

[Salvatore Bonaccorso]

Hi,

On Fri, Jul 10, 2026 at 06:39:45PM +0200, Hefee wrote:
> Hi Salvatore
> 
> actually upstream marked both CVEs as fixed in 2.6.4:
> TEMP-1139716-6892B6
> TEMP-1139717-36B614
> 
> I uploaded 2.6.4 to unstable, so at least sid and testing will be fixed.
> Unfortunately the diff between 2.6.3 and 2.6.4 is quite big :( So I'm currently 
> investigating the source, if I can extract the patches to fix the CVEs.

Thanks, I have updated the tracker to reflect the status with fixed
version. 

for trixie, you see we marked it no-dsa, but if it turns out that it
is becoming too complicated, then a point release update might as well
not be realistic. Let us know how it goes.

> Thanks for all your work!

Same! Thanks for putting energy into this one here in particular as
well.

Regards,
Salvatore