Re: Bug#1142123: bookworm-pu: package modsecurity/3.0.9-1+deb12u3
Hi Alberto,
On Wed, Jul 15, 2026 at 05:25:55PM +0200, Alberto Gonzalez Iniesta wrote:
> Package: release.debian.org
> Severity: normal
> Tags: security
> X-Debbugs-Cc: modsecurity@packages.debian.org, airween@gmail.com, Debian Security Team <team@security.debian.org>
> Control: affects -1 + src:modsecurity
> User: release.debian.org@packages.debian.org
> Usertags: pu
>
> [ Reason ]
> Fixes for CVE-2026-52747 and CVE-2026-52761
>
> [ Impact ]
> Security rules bypass.
>
> [ Tests ]
> Fixed and tested by upstream.
>
> [ Risks ]
> Low risk, simple patch.
>
> [ Checklist ]
> [x] *all* changes are documented in the d/changelog
> [x] I reviewed all changes and I approve them
> [x] attach debdiff against the package in (old)stable
> [x] the issue is verified as fixed in unstable
>
> [ Changes ]
> Preserve line breaks from non-file form-field values.
> Fix returned length of "unicode" variable.
> diff -Nru modsecurity-3.0.9/debian/changelog modsecurity-3.0.9/debian/changelog
> --- modsecurity-3.0.9/debian/changelog 2026-04-30 17:13:44.000000000 +0200
> +++ modsecurity-3.0.9/debian/changelog 2026-06-30 19:11:37.000000000 +0200
> @@ -1,3 +1,14 @@
> +modsecurity (3.0.9-1+deb12u3) bookworm; urgency=medium
> +
> + [ Alberto Gonzalez Iniesta ]
> + * Restore d/changelog entry for deb12u1
> + * Fix CVE number
> +
> + [ Ervin Hegedus ]
> + * Add fixes for CVE-2026-52747 and CVE-2026-52761
> +
> + -- Ervin Hegedüs <airween@gmail.com> Tue, 30 Jun 2026 19:11:37 +0200
As this proposed update targets 'bookworm'. Debian bookworm is now
handed over to the LTS team, so no point releases are happening
anymore, but updates are released via DLA's. I'm cc'ing the LTS list.
Regards,
Salvatore
Reply to: