Package: passenger Version: 6.0.26+ds-1.1 Severity: normal Tags: security X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Dear Maintainer, cf as these log entries say: [ E 2026-10-22 00:15:24.9242 20500/T6 age/Cor/SecurityUpdateChecker.h:521 ]: A security update is availa ble for your version (6.0.26) of Phusion Passenger(R). We strongly recommend upgrading to version 6.2.1. [ E 2026-10-22 00:15:24.9242 20500/T6 age/Cor/SecurityUpdateChecker.h:526 ]: Additional security update check information: - [Fixed in 6.2.0] [CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, CVE number pending] Various vulnerabilities in Nginx addressed by bumping Passenger Standalone's Nginx engine to 1.30.4, please see referenced CVEs. Also a LPE bug in Passenger Watchdog's API server was fixed, CVE pending. Likely solution: make version 6.2.0 from forky available in trixie, unwanted side effects to be tested hth, wim -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.113+deb13-amd64 (SMP w/8 CPU threads; PREEMPT) Locale: LANG=nl_BE.UTF-8, LC_CTYPE=nl_BE.UTF-8 (charmap=UTF-8), LANGUAGE=nl_BE:nl Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages passenger depends on: ii libc6 2.41-12+deb13u4 ii libcurl4t64 8.14.1-2+deb13u7 ii libev4t64 1:4.33-2.1+b1 ii libgcc-s1 14.2.0-19 ii libruby 1:3.3+b1 ii libruby3.3 3.3.8-2 ii libssl3t64 3.5.7-1~deb13u3 ii libstdc++6 14.2.0-19 ii libuv1t64 1.50.0-2 ii ruby 1:3.3+b1 ii ruby-rack 3.1.20-0+deb13u2 passenger recommends no packages. Versions of packages passenger suggests: ii nodejs 20.19.2+dfsg-1+deb13u3 ii python3 3.13.5-1 pn rails <none> -- no debconf information
