On 08/10/2026 22:00, Roberto C. Sánchez wrote:
Hello Release Team,
On Thu, Oct 08, 2026 at 04:21:01PM +0530, Jeevan Chalke wrote:
Package: src:mongo-c-driver
Version: 1.30.4-1+deb13u3
Severity: grave
Tags: security patch
X-Debbugs-Cc: [1][email protected]
Dear Maintainer,
debian/patches/0009_CVE-2026-81524.patch (the backport of upstream
CDRIVER-6424, "validate db and collection names") breaks
mongoc_collection_aggregate() for every collection. It always returns a
cursor in the error state:
I am already in the process of preparing a 1.30.4-1+deb13u4 version of
mongo-c-driver to target the next point release. However, this bug
report appears to be of somewhat higher urgency. Should I upload a
1.30.4-1+deb13u4 containing only the fix for #1150302 for immediate
upload with the intent of a SUA to get the fix landed more quickly? I
would then defer the other fixes I am working on to 1.30.4-1+deb13u5.
Thanks in advance for your guidance.
It's your call, but that sounds reasonable.
Cheers,
Emilio
