Debian LTS and ELTS report: March and April 2026

["Andrej Shadura" <andrewsh@debian.org>]

Hello everyone,

Here’s my report for the work I’ve done for Debian LTS and ELTS in March and
April 2026.

Thanks to Freexian and sponsors for making this possible:
https://www.freexian.com/lts/debian/#sponsors

LTS
===

libyaml-syck-perl

    I’ve uploaded a straight-forward port of the patches for two CVEs
    from bookworm.

mbedtls

    Finally, after such a long time, I was able to port all necessary
    upstream patches in order to patch CVE-2025-59438. I have also
    ported a trivial fix for an issue on systems with no getrandom()
    (CVE-2026-34871). This still needs to be fixed in both unstable and
    stable, see https://bugs.debian.org/1132577.

ELTS
====

libyaml-syck-perl

    I’ve made an upload fixing the same issues as in LTS, but with an
    extra fix for a memory corruption error, which is a dependency of
    the patches I ported.

-- 
Cheers,
  Andrej