Your message dated Sun, 23 Aug 2026 14:18:14 +0200
with message-id <[email protected]>
and subject line Re: Accepted swtpm 0.10.2-1 (source) into unstable
has caused the Debian Bug report #1144810,
regarding swtpm: CVE-2026-75900
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144810: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144810
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: swtpm
Version: 0.10.1+ds-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 0.7.1-1.5
Hi,
The following vulnerability was published for swtpm.
CVE-2026-75900[0]:
| Fix length check in SWTPM_NVRAM_CheckHeader()
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-75900
https://www.cve.org/CVERecord?id=CVE-2026-75900
[1]
https://github.com/stefanberger/swtpm/commit/afc9e512a0459b12776e8fa509cfa039908c6be6
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: swtpm
Source-Version: 0.10.2-1
This upload fixes as well the reported #1144810 (CVE-2026-75900), but
the upload missed the bug closer. I'm doing manually.
Regards,
Salvatore
On Sun, Aug 23, 2026 at 09:34:02AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Sun, 23 Aug 2026 10:20:34 +0100
> Source: swtpm
> Architecture: source
> Version: 0.10.2-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Luca Boccassi <[email protected]>
> Changed-By: Luca Boccassi <[email protected]>
> Closes: 1144841
> Changes:
> swtpm (0.10.2-1) unstable; urgency=medium
> .
> [ Alexandre Detiste ]
> * use dh-cruft to register & clean /var/lib/swtpm-localca on purge
> .
> [ Luca Boccassi ]
> * d/t/control: depend on iproute2 (Closes: #1144841)
> * Build-depend on iproute2 for unit test scripts
> * New upstream version 0.10.2
> * Drop priority: optional, now it's default
> * Drop Rules-Requires-Root: no, now it's default
> * Bump Standards-Version to 4.7.4
> * Switch to dh-compat 14
> * Drop patch merged upstream
> * Add d/u/metadata file
> Checksums-Sha1:
> 7e4515cad7235caf14bf36359faf08816fdcff46 2450 swtpm_0.10.2-1.dsc
> 57a4221c75aac101fc3ec3d141df2dcf0ad10690 309384 swtpm_0.10.2.orig.tar.xz
> a7effd925b52e32fc9bcf9df439b62e3fccfde77 9732 swtpm_0.10.2-1.debian.tar.xz
> d80a4b38e99dd280c03ed6d4274f96043028442b 10815
> swtpm_0.10.2-1_source.buildinfo
> Checksums-Sha256:
> 98cb369130f014972d9f6f2e2defa7319e6fc9d7ae33f8415963cd536c5e8bb7 2450
> swtpm_0.10.2-1.dsc
> 314f2b09c75b1327ee079f81b58e732fdee46c9c3b3a3358a6f3b92a1e85ca83 309384
> swtpm_0.10.2.orig.tar.xz
> adb38919c5ffc727b3a2ed5ab6225a79e2d75a9c24bc46c74a064204f2c0d037 9732
> swtpm_0.10.2-1.debian.tar.xz
> 46757b717c59e4957dee42602516ac365463ca8abe954b9a9603237e4773c887 10815
> swtpm_0.10.2-1_source.buildinfo
> Files:
> 755d4262e7b860b145454fd9a66dc2f7 2450 misc optional swtpm_0.10.2-1.dsc
> 1450781416cc556d6c16f63b59490536 309384 misc optional
> swtpm_0.10.2.orig.tar.xz
> bcf36d7d5faa4867169ecfca509adec1 9732 misc optional
> swtpm_0.10.2-1.debian.tar.xz
> f1897abeec0bc09d783981c55468b396 10815 misc optional
> swtpm_0.10.2-1_source.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQJFBAEBCgAvFiEErCSqx93EIPGOymuRKGv37813JB4FAmqKu6YRHGJsdWNhQGRl
> Ymlhbi5vcmcACgkQKGv37813JB5JXRAArrv4DuOAFelnGITae8ptStY9xX1Qavl8
> W6oMbct3o50o+T9euWKCDIgNQ5xf3PpuhHQVu9Xj2U2tYzCxjswjKb6qxPFSJ+Vy
> 03jxnRpSZ0FgngwPE9r9iIqa0tw4YFMehfg2A0wzwFiwJ+udxeSak8q9Sc9l1rxa
> z4hsSAwNsL4wgQXsNlTTxCVtobB6jgJHERCnu8hnH1WZn4yo3oRRef+00+MBQS+8
> lZTSZHXn8IlqzDwSmjhmIaZ8wN1SO+ncWy8t+Q59zMLcP5sP9lnCE9X/bwqabZLZ
> jt0FYoc7h+SRfVh2X72j2Rwsp63nK//ueguZoYDaxOWOj4BgUo78x+xiQ/aE8ifX
> 5Qe3L8W5kRkvxIHrQHRsmwF7WATyuGpYJFhc0tYGDdotWUTUM+xyVMpOlk3RlmgW
> Z3to/LFmAx+rCj2Y5a+jqKf9SjqaWwYgtDFGrf7lEFbMLnia9/EcizlyJoy5NRW7
> M1av/WSRf1nLOV7Dqbg3XDFcIM4h5Fq1BcFLvzSkJD/hFSnIS4fhv2vhoccsMg4s
> bLyyZFvKuPxF9OcUebz5iyOkdV/fW7vQYydsiez0/HyMu8hHJlpUwNP6Oe/L+dTh
> aYDVa+J6s/Rp7oB8EdQ15l16eR0CmznarmvretpjoRtKxbVX9kcxiQ89i3tYNLbW
> YUXIfZgP2y4=
> =DB30
> -----END PGP SIGNATURE-----
--- End Message ---
