Your message dated Sat, 12 Sep 2026 08:05:40 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1141973,
regarding trixie-pu: package bettercap/2.33.0-1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141973: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141973
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu
Dear Release Team,
I would like to update the bettercap on the trixie to prevent remote DoS via
crafted client handshake on mysql.server module, because during a review of
the Debian Security Tracker, I found CVE-2026-8276.
There is no DSA assigned to the bug and it was marked "no-dsa" and so I'm doing
a normal upload.
"mysql.server crashes entire process on crafted client handshake (remote DoS)",
as reported in: https://github.com/bettercap/bettercap/issues/1265
This vulnerability has been assigned the CVE id CVE-2026-8276.
Upstream fixed the bug at:
https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8276
[1] https://security-tracker.debian.org/tracker/CVE-2026-8276
[2] https://bugs.debian.org/1136448
Regards,
Francisco
diff -Nru bettercap-2.33.0/debian/changelog bettercap-2.33.0/debian/changelog
--- bettercap-2.33.0/debian/changelog 2024-08-18 20:54:15.000000000 +0000
+++ bettercap-2.33.0/debian/changelog 2026-07-13 02:41:40.000000000 +0000
@@ -1,3 +1,10 @@
+bettercap (2.33.0-1+deb13u1) trixie; urgency=medium
+
+ * Add debian/patches/CVE-2026-8276.patch.
+ (Closes: #1136448, CVE-2026-8276)
+
+ -- Francisco Vilmar Cardoso Ruviaro <[email protected]> Mon, 13 Jul 2026
02:41:40 +0000
+
bettercap (2.33.0-1) unstable; urgency=medium
* New upstream version 2.33.0.
diff -Nru bettercap-2.33.0/debian/patches/CVE-2026-8276.patch
bettercap-2.33.0/debian/patches/CVE-2026-8276.patch
--- bettercap-2.33.0/debian/patches/CVE-2026-8276.patch 1970-01-01
00:00:00.000000000 +0000
+++ bettercap-2.33.0/debian/patches/CVE-2026-8276.patch 2026-07-13
02:34:14.000000000 +0000
@@ -0,0 +1,34 @@
+Description: Fix mysql.server panic on crafted client handshake (remote DoS).
+Author: Simone Margaritelli <[email protected]>
+Origin: upstream,
https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e.patch
+Bug: https://github.com/bettercap/bettercap/issues/1265
+Bug-Debian: https://bugs.debian.org/1136448
+Forwarded: not-needed
+Reviewed-By: Francisco Vilmar Cardoso Ruviaro <[email protected]>
+Last-Update: 2026-07-10
+
+--- a/modules/mysql_server/mysql_server.go
++++ b/modules/mysql_server/mysql_server.go
+@@ -121,15 +121,20 @@ func (mod *MySQLServer) Start() error {
+ if _, err := conn.Write(packets.MySQLGreeting);
err != nil {
+ mod.Warning("error while writing server
greeting: %s", err)
+ continue
+- } else if _, err = reader.Read(readBuffer); err
!= nil {
++ } else if read, err = reader.Read(readBuffer);
err != nil {
+ mod.Warning("error while reading client
message: %s", err)
+ continue
+ }
+
++ if read < 37 {
++ mod.Warning("client handshake too short
(%d bytes)", read)
++ continue
++ }
++
+ // parse client capabilities and validate
connection
+ // TODO: parse mysql connections properly and
+ // display additional connection
attributes
+- capabilities := fmt.Sprintf("%08b",
(int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
++ capabilities := fmt.Sprintf("%016b",
(int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
+ loadData := string(capabilities[8])
+ username := string(bytes.Split(readBuffer[36:],
[]byte{0})[0])
+
diff -Nru bettercap-2.33.0/debian/patches/series
bettercap-2.33.0/debian/patches/series
--- bettercap-2.33.0/debian/patches/series 2024-08-18 17:41:44.000000000
+0000
+++ bettercap-2.33.0/debian/patches/series 2026-07-13 02:34:56.000000000
+0000
@@ -1,3 +1,4 @@
adapt-service-file.patch
disable-install-update-bettercap.patch
disable-install-update-caplets.patch
+CVE-2026-8276.patch
Regards,
--
Francisco Vilmar Cardoso Ruviaro <[email protected]>
4096R: 1B8C F656 EF3B 8447 2F48 F0E7 82FB F706 0B2F 7D00
OpenPGP_signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
