Your message dated Fri, 10 Jul 2026 16:49:12 +0000
with message-id <[email protected]>
and subject line Bug#1139716: fixed in onionshare 2.6.4-1
has caused the Debian Bug report #1139716,
regarding onionshare: OnionShare Receive mode writes uploaded files even when
file uploads are disabled
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1139716: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139716
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: onionshare
Version: 2.6.3-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi
https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp
> OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode
> disable_files setting at the file upload sink. When a Receive service
> is configured as a text-message-only endpoint (--disable-files /
> "Disable uploading files"), a remote sender who can reach the
> OnionShare service can still send a crafted multipart request
> containing file[]; OnionShare writes the uploaded bytes to disk before
> the route handler skips file accounting.
>
> This affects the shipped onionshare-cli Python package and the desktop
> application because both use the same onionshare_cli.web.receive_mode
> request-streaming implementation.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: onionshare
Source-Version: 2.6.4-1
Done: Sandro Knauß <[email protected]>
We believe that the bug you reported is fixed in the latest version of
onionshare, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sandro Knauß <[email protected]> (supplier of updated onionshare package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 10 Jul 2026 18:23:18 +0200
Source: onionshare
Architecture: source
Version: 2.6.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Privacy Tools Maintainers
<[email protected]>
Changed-By: Sandro Knauß <[email protected]>
Closes: 1139716 1139717
Changes:
onionshare (2.6.4-1) unstable; urgency=medium
.
* New upstream release.
- Fixes TEMP-1139717-36B614 (Closes: #1139717)
- Fixes TEMP-1139716-6892B6 (Closes: #1139716)
* Switch to debhelper 14.
* Update jquery from 3.5.1 to 3.7.1.
* Update socket.io to 4.8.3.
* Update copyright to match updated sources.
* Update debian patches.
* Update lintian-overrides.
Checksums-Sha1:
970f219e8d60dcba5fe75bb3986f5a0bb7f345a8 2993 onionshare_2.6.4-1.dsc
372db1c6b9083dfb8a36840b2c29d9ef3ece9e13 8994163 onionshare_2.6.4.orig.tar.gz
65821aaab9d8ca865f0c2ef0b3dd2c3e31829543 101900
onionshare_2.6.4-1.debian.tar.xz
Checksums-Sha256:
b244c51f2224c1f9d292dd3ef3a842d1a9614ae9ca18e7f662a79353f84b3c58 2993
onionshare_2.6.4-1.dsc
94b8e87d325a48b8e7c9eb53dbe2779d76e0b32dccb68267e86c8a18149968a1 8994163
onionshare_2.6.4.orig.tar.gz
d4f91f9f5773cd2347a46adcde7c95a245dd69c4635c02b59bb71442d6df5a70 101900
onionshare_2.6.4-1.debian.tar.xz
Files:
63161d82a3ad06f49e7865545a19754e 2993 net optional onionshare_2.6.4-1.dsc
917094e28452e74339f819b0e528c98f 8994163 net optional
onionshare_2.6.4.orig.tar.gz
41937661ee5f3d1fcfcb64866dfbf43a 101900 net optional
onionshare_2.6.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEOewRoCAWtykmSRoG462wCFBgVjYFAmpRHRoRHGhlZmVlQGRl
Ymlhbi5vcmcACgkQ462wCFBgVjYEaA/8DDnBoaM8J9AOSMjBg4AimEMLaiFZGCA/
c8rUHRL0xLrxx6caGQmy3KN/byZUCI5/o8mBr8GNMdYvuBvZeln4voWyd0S51ay4
GdvMbCGF+HJqbL1g9pRpuVe8My96RJZTU5cYm0HhEGXd9pVBpjVL9YkKByvvJ8vd
o/nynlnkJzJEF7NqQ2tyTtBM19DIlr5Ihf9yihQwK/FQiK1cG04fCajZFaAWw1Ka
0f939aFAIIx+oAF8M93mrmcX/dEuchC8Tigv1Typ+QXOrJr1wycaFU+eBYFSfhCy
Sc8/waFh4Q0cdU4yhomOOPpPZo86UKuQdL8eqNk4pNzJIiJErtWX0CQPsrmzIcw/
GVxD7Ld23RFYL8U+C6Wj2Iwjaks1kkqbwcVq0FVQBU68/BOTfZ/0Ns5a6yOeBcE5
72iKqzAReFx7FfsA3QqOISoQU1ySWThfczhVEjMnnoChyeQOpmd+bNWLJ82CyF7C
yKyN2WU+NW56BM/nHxlEbxlirI8QGic5+2C07jpI4/J9jGesdzbsqnaBsm1Omyr8
a6KEyFu+DNT9j1jIwLPs717zirXUn9+ucfNfiLye6XXKNkcZ5mZ4n3cPEq3DsY64
YfH87WD8qPLti1TSMtR3M4nWsQ7Rj1EMU5fEo3C9i8nXzOkSyqidvMY9Hqjf1A3/
p1M3GpadorY=
=J50f
-----END PGP SIGNATURE-----
pgpypCBaydWDd.pgp
Description: PGP signature
--- End Message ---
