Your message dated Wed, 28 Oct 2026 05:59:11 +0100
with message-id <[email protected]>
and subject line Re: Accepted rust-zip 9.0.5+ds-1 (source) into unstable
has caused the Debian Bug report #1152227,
regarding rust-zip: CVE-2026-115905 CVE-2026-115906 CVE-2026-115907
CVE-2026-115909
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1152227: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152227
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rust-zip
Version: 5.1.1+dfsg-1
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerabilities were published for rust-zip.
CVE-2026-115905[0]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory
| File Header filenames as authoritative while ZipStreamReader
| extracts using Local File Header filenames without reconciling the
| duplicate metadata in src/read/stream.rs. A crafted archive can
| therefore appear benign to a component that inspects the central
| directory but cause a streaming extractor to write a different
| attacker-selected path and content, potentially overwriting files
| used by a downstream service. This issue is fixed in version 9.0.5.
CVE-2026-115906[1]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in
| src/aes.rs verifies its HMAC only when the attacker-controlled data
| counter reaches zero. If the underlying bounded reader reaches the
| real end of the archive while data_remaining is still positive, or
| if an encrypted entry has no payload, the reader can return a clean
| end of stream without reading and comparing the authentication tag.
| Applications using by_index_decrypt, by_name_decrypt,
| by_path_decrypt, or password-enabled by_index_with_options can
| therefore accept modified plaintext without an authentication error.
| This issue is fixed in version 9.0.0.
CVE-2026-115907[2]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 5.1.0 until 9.0.0, applications built with
| the legacy-zip feature can reserve output capacity from an attacker-
| controlled ZIP64 uncompressed size before validating the compressed
| stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic
| with a capacity overflow during ZipArchive::extract, and the Reduce
| and Implode decoders contain the same unbounded preallocation
| pattern. An unhandled panic can terminate an archive-processing
| service. This issue is fixed in version 9.0.0.
CVE-2026-115909[3]:
| zip is a zip library for Rust that supports reading and writing
| simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in
| src/read/mod.rs calls Vec::with_capacity for a symbolic link target
| using the attacker-controlled ZIP64 uncompressed_size before reading
| entry data. A small archive can request an impossible capacity,
| causing the infallible allocation path to abort the process before
| the entry is validated. The failure cannot be contained with
| catch_unwind or a worker thread, allowing repeated denial of service
| in archive-processing applications. This issue is fixed in version
| 9.0.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-115905
https://www.cve.org/CVERecord?id=CVE-2026-115905
[1] https://security-tracker.debian.org/tracker/CVE-2026-115906
https://www.cve.org/CVERecord?id=CVE-2026-115906
[2] https://security-tracker.debian.org/tracker/CVE-2026-115907
https://www.cve.org/CVERecord?id=CVE-2026-115907
[3] https://security-tracker.debian.org/tracker/CVE-2026-115909
https://www.cve.org/CVERecord?id=CVE-2026-115909
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: rust-zip
Source-Version: 9.0.5+ds-1
Hi,
This fixes as well the recent CVEs tracked in #1152227. Closing
manually but please double-check as we..
On Tue, Oct 27, 2026 at 06:07:24PM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Tue, 27 Oct 2026 18:14:56 +0100
> Source: rust-zip
> Architecture: source
> Version: 9.0.5+ds-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian Rust Maintainers
> <[email protected]>
> Changed-By: Alexander Kjäll <[email protected]>
> Changes:
> rust-zip (9.0.5+ds-1) unstable; urgency=medium
> .
> * Team upload.
> * Package zip 9.0.5 from crates.io using debcargo 2.8.4
> Checksums-Sha1:
> bc838495431cfc0a7d203f2f3bd0c164c066f483 3013 rust-zip_9.0.5+ds-1.dsc
> ca4c70aab0d9143d40791c49b4ad51d3ae158675 184037 rust-zip_9.0.5+ds.orig.tar.gz
> 71006b33de5ea2a60dd57a15390552ad4f1d6299 9004
> rust-zip_9.0.5+ds-1.debian.tar.xz
> dd08eb96f1c620b3bb81d318d07b96c1440deac0 7063
> rust-zip_9.0.5+ds-1_source.buildinfo
> Checksums-Sha256:
> ef55232986b55ea703405ced8fc16dd748cfe93f5090dbbbb4cae75c1897711d 3013
> rust-zip_9.0.5+ds-1.dsc
> 6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e 184037
> rust-zip_9.0.5+ds.orig.tar.gz
> d5000e3f674c798fe323fa9468e3a8be15067121b459910781469e4d6c82ce24 9004
> rust-zip_9.0.5+ds-1.debian.tar.xz
> de764d76de3d2d03d0e83b6caabef37fc8ed4b3bbac174e18124045f973b365c 7063
> rust-zip_9.0.5+ds-1_source.buildinfo
> Files:
> abb3a5377827dd225c562f7ce02f66d4 3013 rust optional rust-zip_9.0.5+ds-1.dsc
> c2ca6ae9622ebb453169b63d1b781acf 184037 rust optional
> rust-zip_9.0.5+ds.orig.tar.gz
> 2c133345f15c397c15da9284424d2151 9004 rust optional
> rust-zip_9.0.5+ds-1.debian.tar.xz
> 38cc9829ba4480848b38e08afe4e45d1 7063 rust optional
> rust-zip_9.0.5+ds-1_source.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iHUEARYKAB0WIQTjXSWUWAMcT4Fcz+oDR6wEe1CAhQUCauDcEwAKCRADR6wEe1CA
> heV1AP0aJYLT7PYxRpKZKqNeoSvkI6ElBC6Y7MxgAxItQc1imgD+Pu02z6SUeNgb
> 2/9oUzXyTyuXYCkvKzYRfeXSGlb67Ak=
> =07VF
> -----END PGP SIGNATURE-----
Regards,
Salvatore
--- End Message ---
