Security fixes
- DLA-4446-1 python-urllib3 for Debian 11 "Bullseye" . Python-urllib3, an HTTP library with thread-safe connection pooling for Python, was vulnerable to decompression bomb when following HTTP redirects via the streaming API, which could lead to Denial of Service. Fixed in
1.26.5-1~exp1+deb11u3. - DSA-6109-1 incus for Debian 13 "Trixie" . Bugs in incus could result the in execution of arbitrary commands via malformed images. Fixed in
6.0.4-2+deb13u4. - DLA-4426-2 osslsigncode for Debian 11 "Bullseye" . Fix for vulnerability was released in DLA 4426-1 by upgrading to version 2.5-4, which had a known bug #1076785. This issue is fixed by updating to version 2.9. Fixed in
2.5-4~deb11u1+really2.9-1+deb11u2.
Announcements and releases
- Project Secretary Appointment on debian-devel-announce .
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).