Security fixes
- DLA-4843-1 python-django for Debian 12 "Bookworm" . Two vulnerabilities were discovered in Django, the popular Python web-development framework. CVE-2026-77050 Potential denial-of-service vulnerability in get_supported_language_variant. This method was subject to a potential denial-of-service attack when processing many distinct and very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, pot Fixed in
3:3.2.25-0+deb12u6. - DLA-4844-1 libssh for Debian 12 "Bookworm" . Several vulnerabilities were discovered in libssh, a tiny C SSH library. A malicious SCP server can send a path that escapes the working directory. This is the same issue as OpenSSH . Parsing a configuration file that is not a regular file, or that is too large, could be used for a denial of service. Fixed in
0.10.6-0+deb12u3. - DSA-6572 ca-certificates for Debian 13 "Trixie" . It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. Fixed in
20250419+deb13u1. - DLA-4845-1 ca-certificates for Debian 12 "Bookworm" . It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. Fixed in
20250419~deb12u2.
Announcements and releases
No formal project announcements.
Project and event news
- Steinar H. Gunderson posted decompilation patterns, part 17 (loop rotation).
- Thadeu Lima de Souza Cascardo wrote about restricting device memory usage on Linux 7.3.
Notable discussions
- Replies kept coming on the Northstar browser and systemd-only package threads.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.