Your message dated Thu, 24 Sep 2026 18:51:47 +0000
with message-id <[email protected]>
and subject line Bug#1148331: fixed in mongo-c-driver 2.5.5-1
has caused the Debian Bug report #1148331,
regarding mongo-c-driver: CVE-2026-93393
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148331: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148331
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mongo-c-driver
Version: 2.5.3-1
Severity: important
Tags: security upstream
Forwarded: https://jira.mongodb.org/browse/CDRIVER-6417
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for mongo-c-driver.
CVE-2026-93393[0]:
| A heap-based buffer overflow exists in the TLS transport layer of
| the MongoDB C Driver when built with the Windows platform TLS
| backend. A remote endpoint that the client connects to can cause the
| driver to write uncontrolled data outside the bounds of a heap
| allocation while processing incoming encrypted traffic after the TLS
| handshake completes. No authentication or user interaction is
| required, because the affected processing occurs before any
| application-level authentication completes. Triggering this issue
| may lead to memory corruption in the client process, disclosure of
| adjacent heap memory, or termination of the process.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93393
https://www.cve.org/CVERecord?id=CVE-2026-93393
[1] https://jira.mongodb.org/browse/CDRIVER-6417
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: mongo-c-driver
Source-Version: 2.5.5-1
Done: Roberto C. Sanchez <[email protected]>
We believe that the bug you reported is fixed in the latest version of
mongo-c-driver, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Roberto C. Sanchez <[email protected]> (supplier of updated mongo-c-driver
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 24 Sep 2026 12:45:04 -0400
Source: mongo-c-driver
Architecture: source
Version: 2.5.5-1
Distribution: unstable
Urgency: medium
Maintainer: Mongo C Driver Team <[email protected]>
Changed-By: Roberto C. Sanchez <[email protected]>
Closes: 1148331
Changes:
mongo-c-driver (2.5.5-1) unstable; urgency=medium
.
* New upstream release (Closes: #1148331)
Checksums-Sha1:
13e5f44a3af7aaba7020671028423282de20a026 2697 mongo-c-driver_2.5.5-1.dsc
082956724688b89e59074fc0bbeeb691bd5e51db 7150611
mongo-c-driver_2.5.5.orig.tar.gz
3fa06648148eaf8a2afb7536eac8b90edd5c3e93 10184
mongo-c-driver_2.5.5-1.debian.tar.xz
cae3e7e530c9da17f5e43f36e04b7095a402c581 7152
mongo-c-driver_2.5.5-1_source.buildinfo
Checksums-Sha256:
a828b5150ce8731b98ace12ca4257cce9a87ad9f2e65ff6cfff0355fb50775c3 2697
mongo-c-driver_2.5.5-1.dsc
479ec7a09e30c600929c0082268566e3476878ff6eae7635622ad59458429755 7150611
mongo-c-driver_2.5.5.orig.tar.gz
1e9d96e02e92296d85d44c728927ae0c88f16f048984a3009b69d2d777392498 10184
mongo-c-driver_2.5.5-1.debian.tar.xz
8d25c11e3ff0d1dad733501b9bf0756301845a7fc99afea9d5182ac9986c92a9 7152
mongo-c-driver_2.5.5-1_source.buildinfo
Files:
10bf2ca83ebded05ed68eaee49db163d 2697 libs optional mongo-c-driver_2.5.5-1.dsc
c77832e405951ea019ce304abc5ea8a2 7150611 libs optional
mongo-c-driver_2.5.5.orig.tar.gz
61f8eb0f89fff2aa44807a0de924bd3b 10184 libs optional
mongo-c-driver_2.5.5-1.debian.tar.xz
2e97bb4a52dfb488412bcbf647f00338 7152 libs optional
mongo-c-driver_2.5.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmq1Z3oACgkQldFmTdL1
kUKeHA//cnUUKa2q3MXJR3hQ1tV4SVAq+4cvjpBQUvLf8Af1t+R1ii3GRd6R+vnt
skovKHdZQTRTF0Fxk03m5vCGDvkCGVn7FtdV8ajSruB/ZHsl8zmZQFubO4ndJZxI
52ZpBuEM7+s1PuWbq/sq1jfxbKXz07078wrH9ngttSPE4eydpD4tJ0qfkHDHyT18
wyrUFeFnvOU+gXQvpa947L/3cgtY39Q3KUANqbCZWxHwM0rIEsPWrOkrdofu/6eG
0KAqbQw9/V2GXhirwm69eTFCUKGmaO3E441Q8hcstuSIrhGccjMi0lrRGLz+zDOB
Dr43uxAC60zsnFRdj81lNUd5UKm+NcJMBpg7LE6SdAqhpmPGVoPTi0cR6jkoPNTx
Lp/bVr1gVbHAi8VlwGhjjBOvzP7V0zrZZom7bLoUtaOMpZ5RZX4VF+Y3iEcTTuAL
/dTmFnP4INhW8jtBG3aBdsS7Kv0+pNyQAF+l7C+xtqa600r0kcp8XahHhkGtX8rg
q+NyG/bXf7iE3u6yXri4coEqN2JqgQ/nIviL8jLH02363ChRYSyLJY31u/0IuIIk
MFQ3O7IUkZTG9lSQIW3tBVS4V1LbynOGHMZNKQaRNXTGqgC7Dt7xS4OTpFQCnzY4
LG6wmTmtwwslwwtqhpI4oLdCRb//EmsBZvMSeAIsiZZpFD9ay10=
=K9pM
-----END PGP SIGNATURE-----
pgphU63Qd79AO.pgp
Description: PGP signature
--- End Message ---
