Package: release.debian.org Severity: normal User: [email protected] Usertags: pu Tags: trixie
This fixes a path traversal security vulnerability (CVE-2026-79655) which was marked as <no-dsa>. If not fixed, then users using sos clean on untrusted archives could suffer an arbitrary file overwrite/path traversal attack. Bug #1145981 and the CVE ID CVE-2026-79655 This is low risk, as the patches are direct backports of the upstream fix, isolated strictly to the tar extraction verification logic inside the clean component Debdiff below [ Reason ] sos has a CVE, CVE-2026-79655, which is a low risk for trixie, and has been uploaded to sid, forky, and trixie-backports [ Impact ] The users using sos clean on untrusted archives could suffer an arbitrary file overwrite/path traversal attack. [ Tests ] Ran the reproducer as defined in the upstream bug [1], shown below. The package was built on salsa, and installed on a trixie development machine. root@trixie-dev:~# python3 ./reproducer.py [cleaner] skipping tar member 'sosreport-test/var/log/escape': 'sosreport-test/var/log/escape' is a link to an absolute path OK: file did not escape the extraction directory [ Risks ] sos may not collect the corresponding files for evaluation overall [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in stable [x] the issue is verified as fixed in unstable [ Changes ] Update the included patches that solve the CVE, we had to bring in 1 extra patch as a dependancy, and added extra line for an import of the module for unit tests In unstable this was handled by building with the new sos package, with the relevant patches back-ported from upstream. Created an MR on salsa [2], that shows the diff, and would constitute my debdiff for the update [1] https://github.com/sosreport/sos/issues/4460#issuecomment-6042532211 [2] https://salsa.debian.org/python-team/packages/sosreport/-/merge_requests/35 --- Arif Ali IRC: arif-ali Matrix: @arif-ali:ubuntu.com
