Hi,
Well I don't want to be the only one reviewing your uploads, but here I
am ;)
Overall this looks good :)
On a personal note, I wouldn't bother to rewrite the upstream Git
patches so much to conform to DEP-3, even
https://dep-team.pages.debian.net/deps/dep3/ (first sample) proposes a
lighter approach where most/all the patch header is preserved (and
easier to review / diff against upstream).
Also I wouldn't bother to re-introduce data that is already present in
the security-tracker (debian bug ID, GHSA, etc.), in particular the
security-tracker can be fixed/updated, while info copy/pasted in the
patch header usually desync over time and may cause confusion later.
Usually I do something like:
https://salsa.debian.org/lts-team/packages/runc/-/blob/debian/buster/debian/patches/CVE-2022-29162.patch
possibly with concise backport notes before the upstream patches.
Also note that I include my name so we know who was responsible for the
backport if an issue if found while working on a later upload.
But again this is fine-tuning, the upload look good and the testing solid.
Cheers!
Sylvain Beucler
Debian LTS Team
On 09/10/2026 00:49, Simon Quigley wrote:
Hello,
Bookworm is on libgit2 version 1.5.1+ds-1+deb12u1. Four of the six CVEs
that Trixie fixed in DSA-6453-1 hit that version, so I've backported the
Trixie patches into 1.5.1+ds-1+deb12u2. The debdiff is attached, and
I've pushed the changes to a Salsa fork here: https://salsa.debian.org/
tsimonq2/libgit2/-/tree/debian/bookworm?ref_type=heads
What was fixed:
- CVE-2026-53584: submodule paths from .gitmodules weren't checked for
"..", so a malicious repo could push submodule lookup/add/init/update
outside the work tree. Those paths now return GIT_EINVALID.
- CVE-2026-53585: git_delta_apply would allocate whatever size a delta
header claimed, so a tiny pack could force a huge malloc. Delta results
are capped at 2 GiB by default (GIT_OPT_SET_PACK_MAX_OBJECT_SIZE can
raise it). The two new GIT_OPT_*_PACK_MAX_OBJECT_SIZE values are stuck
on the end of git_libgit2_opt_t so existing values don't shift.
- CVE-2026-53586: after an offsite redirect on the first HTTP request,
the credential callback still saw the original URL, so a helper could
hand the first site's credentials to the new host. It now gets the host
it's actually talking to.
- CVE-2026-5917: the repository path went into single quotes unescaped
in the SSH command, so a ' in the path could run commands on the server.
It's escaped now.
CVE-2026-5917 also closes #1144465 (already closed in unstable by
1.9.7+ds-1).
CVE-2026-53583 and CVE-2026-53587 are not an issue on Bookworm. I marked
them not-affected in security-tracker commit
e5fda4f0c6a330341f8b559c26c84f0665769e22.
CVE-2026-53583 lives in the OpenSSL stream backend. Bookworm builds with
-DUSE_HTTPS=mbedTLS, openssl.c is behind #ifdef GIT_OPENSSL, and the
shipped .so links mbedTLS, not libssl. CVE-2026-53587 is in the object-
format capability parsing that landed in 1.6.1. 1.5.1 simply doesn't
have that code.
Built with sbuild using a Bookworm schroot. dh_auto_test is fine for
static and shared, patches apply cleanly, and the only Lintian warning
is the same pkg-config one we already had. Offline clar suite: 2804/0/46
on deb12u1, 2807/0/46 on this package (the three new ones are upstream's
submodule escape tests). Invasive and util suites match. 936 exported
symbols, identical; gensymbols and abidiff are clean. autopkgtest passed.
I also tested each fix against deb12u1 and then this package:
- CVE-2026-53584: upstream's submodule::escape tests fail 3/5 on
deb12u1, and a submodule with path ../escape-target still shows up. All
5 pass here.
- CVE-2026-53585: indexing upstream's 150-byte delta_100mb.pack (claims
a 100 MiB object) sat around 107 MiB RSS on deb12u1. Here, with the cap
at 42 MiB, it refuses it as too large at ~8 MiB RSS. A pack claiming 3
GiB made deb12u1 try a 3 GiB malloc; this package refuses it with the
default cap before allocating.
- CVE-2026-53586: upstream's redirect_authentication_is_current_host
test against a localhost redirect from :7101 to :7102. Callback
got :7101 on deb12u1, :7102 on this package.
- CVE-2026-5917: no upstream test, so I used a local sshd. A path ending
in '; touch /tmp/pwned_5917; ' created the file on deb12u1. Here the
path went out escaped, no file, and the server just said it wasn't a git
repository.
I rebuilt the reverse dependencies against both deb12u1 and this package
in Bookworm schroots, and found no regressions. If you would like more
details on this, or if I should test something specific, just let me know.
Salsa pipeline: https://salsa.debian.org/tsimonq2/libgit2/-/
pipelines/1186327
Debusine work request: https://debusine.debian.net/debian/developers/
work-request/1434734/
This is my first LTS NMU; feedback is appreciated. If nothing
showstopping comes up, I'll upload this and issue the DLA on Monday
morning (October 12th, 2026).
Best regards,
Simon Quigley
[email protected]
