Public bug reported: A new release of libauthen-sasl-perl is available for merging from Debian.
Ubuntu: 2.2000-1ubuntu1 Debian Unstable: 2.2000-2 ### New Debian Changes ### libauthen-sasl-perl (2.2000-2) unstable; urgency=medium * Fix CVE-2026-86219: Replay attack against Authen::SASL::Perl::DIGEST_MD5 -- Salvatore Bonaccorso <[email protected]> Sun, 06 Sep 2026 20:34:38 +0200 ### Old Ubuntu Delta ### libauthen-sasl-perl (2.2000-1ubuntu1) stonking; urgency=medium * SECURITY UPDATE: authentication replay / session hijacking - debian/patches/CVE-2026-86219.patch: verify the client-supplied nonce in server_step against the nonce issued in the digest-challenge, rejecting captured responses replayed against a later session (RFC 2831 section 2.1.2). - CVE-2026-86219 -- Allen Huang <[email protected]> Mon, 28 Sep 2026 13:37:25 +0100 ** Affects: libauthen-sasl-perl (Ubuntu) Importance: Wishlist Status: New ** Tags: dcr-merge ** Changed in: libauthen-sasl-perl (Ubuntu) Importance: Undecided => Wishlist ** Changed in: libauthen-sasl-perl (Ubuntu) Milestone: None => ubuntu-26.11 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171219 Title: Merge libauthen-sasl-perl 2.2000-2 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libauthen-sasl-perl/+bug/2171219/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
