Hello, On 10/16/26 03:25, ChangZhuo Chen (陳昌倬) wrote:
On Fri, Oct 16, 2026 at 09:50:55AM +0200, Sylvain Beucler wrote:Hi,On 15/10/2026 22:21, Simon Quigley wrote:On 10/15/26 07:33, Sylvain Beucler wrote:On Tue, Oct 13, 2026 at 02:41:40PM -0500, Simon Quigley wrote: You also mention "Upstream still asserts on this input, so the patch is original." Do you mean we're fixing behavior that is unfixed upstream and/or unstable? We shouldn't divert that way.On CVE-2026-47770, right, upstream still asserts in jv_delpaths() on this input. The fix I'm carrying is the same guard Trixie already shipped in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm is catching up to Trixie, not going its own way. It also stops the abort that deb12u2 introduced after DLA-4662-1. I'm happy to reword the patch header to say that, or drop it if you don't think Trixie shipping this before unstable warrants including it.I am confused about this. What patch is unfixed in upstream/unstable in Trixie? The patch for CVE-2026-47770 in Trixie is [0]. Looks like it is cherry-pick from upstream. Do you mean this patch contains change in Trixie only due to jq version? [0] https://salsa.debian.org/debian/jq/-/blob/debian/trixie/debian/patches/CVE-2026-47770.patch?ref_type=heads
The guard I mean isn't in Trixie's CVE-2026-47770.patch, which is a straight upstream cherry-pick like you say. It's in Aron's fix-invalid-jv-propagation.patch, the one that makes jv_delpaths() return the invalid jv instead of aborting. Trixie already shipped that in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm would be following Trixie here, not diverging.
trixie diverting isn't a sufficient reason to align all other dists IMHO, maybe it's an error in trixie, maybe it isn't, let's hear from the maintainer -- who is fortunately already in Cc:. @czchen, what do you think? Is this original fix a high regression or security issue that's worth fixing from unstable down?I thin the fix shall be in upstream -> unstable -> stable/oldstable order in general.
Would you want to get this guard into upstream and then unstable? Would you like my help? In the meantime I'll keep the other fixes as a new DLA. Would you rather I drop this extra patch for Bookworm in the meantime? Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
