Security fixes
- DLA-4461-1 python-tornado for Debian 11 "Bullseye" . Tornado is a scalable, non-blocking Python web framework and asynchronous networking library. Custom reason phrases can cause multiple vulnerabilities (like XSS, header injection, ...) due to being used unescaped in HTTP headers. Fixed in
6.1.0-1+deb11u3. - DLA-4462-1 pillow for Debian 11 "Bullseye" . Bugs in pillow were fixed. The getrgb function is susceptible to a ReDoS. Fixed in
8.1.2+dfsg-0.3+deb11u3. - DSA-6117-1 python-django for Debian 13 "Trixie" . Bugs in python-django could lead to SQL injection, directory traversal or denial of service. Fixed in
3:4.2.27-0+deb13u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Debian in the news
- FOSDEM hosts a Debian Med talk on biomedical research. FOSDEM’s January 31 programme includes Andreas Tille’s “Debian Med beyond COVID-19” talk in the Bioinformatics & Computational Biology track. The session describes Debian Med’s support for biomedical research and improvements in packaging, continuous integration and collaboration. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).