Debian LTS/ELTS report - July 2026

[Arnaud Rebillout <arnaudr@debian.org>]

During the month of July 2026 and on behalf of Freexian, I worked on the
following:

### dpkg

Uploaded `1.20.14` in Debian LTS, issued DLA-4673-1, fixing:

  * CVE-2025-6297
  * Debian bugs: #1061404 #1065575 #1107971 #1108192

The actual work on the package was done by Guillem Jover, cf.
<https://lists.debian.org/debian-dpkg/2026/07/msg00005.html>. I did the
upload and followed-up with QA checks on <https://debusine.debian.net>.

### openssl

Uploaded `1.1.0l-1~deb9u13` (stretch) and `1.1.1n-0+deb10u10` (buster) for
Debian ELTS, issued ELA-1773-1, fixing:

  * CVE-2026-7383
  * CVE-2026-9076
  * CVE-2026-28387
  * CVE-2026-28388
  * CVE-2026-28389
  * CVE-2026-28390
  * CVE-2026-34180
  * CVE-2026-42766
  * CVE-2026-45447

### Misc

Debusine: kernel fails to install or upgrade in autopkgtest testbed (bullseye)
- <https://salsa.debian.org/freexian-team/debusine/-/work_items/1521>
- <https://salsa.debian.org/freexian-team/debusine/-/merge_requests/3204>

Debusine: discuss capabilities in autopkgtest environment, for dpkg package:
- <https://salsa.debian.org/freexian-team/debusine.debian.net/support/-/work_items/19>
- <https://salsa.debian.org/freexian-team/debusine.debian.net/workspace-developers/-/merge_requests/3>
- <https://bugs.debian.org/1142100>

Review `dnsmasq` update for ELTS (with Lukas Märdian):
- buster: <https://salsa.debian.org/lts-team/packages/dnsmasq/-/merge_requests/1>
- stretch: <https://salsa.debian.org/lts-team/packages/dnsmasq/-/merge_requests/2>

Review `python3.7` update for ELTS (with Emmanuel Arias).

### Thanks

Thanks to our sponsors for making this possible, and to Freexian for
handling the offering: <https://www.freexian.com/lts/debian/#sponsors>.

--
Arnaud