[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1113711: marked as done (trixie-pu: package libcommons-lang3-java/3.17.0-1+deb13u1)

Your message dated Sat, 15 Nov 2025 11:21:45 +0000
with message-id <736c7150dc08501cc89945035c406eaf9688e144.camel@adam-barratt.org.uk>
and subject line Closing requests for updates included in 13.2
has caused the Debian Bug report #1113711,
regarding trixie-pu: package libcommons-lang3-java/3.17.0-1+deb13u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1113711: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113711
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libcommons-lang3-java@packages.debian.org
Control: affects -1 + src:libcommons-lang3-java
User: release.debian.org@packages.debian.org
Usertags: pu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[ Reason ]

This upload attempts to fix CVE-2025-48924, an uncontrolled recursion
vulnerability that can lead to a StackOverflowError, for users of Debian
Trixie.

[ Impact ]

If the update is not approved, users might be affected by CVE-2025-48924.

[ Tests ]

The patch adds a new test to check if the fix is successful. I also did some
successful manual testing.

[ Risks ]

There is the risk of regression. But the patch is rather small and tested.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

The patch uses the official rewrite that avoids the recursion.

[ Other info ]

The issue has been fixed in LTS as well and will be going to be fixed in ELTS.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmi1lqkACgkQS80FZ8KW
0F1JJQ/+Pye+XLnhmxdtDjw65yNRitQpv75TAOTlI/c8DbR2wWWdi0YdT1xBNQOy
Pa4B9epOIpcy/xHQAvvbsMj9i1ol3dRBFqkWb0vigEU1mbSA7kqyIZcYF/uaTb5Z
ufRbVzVNkAiNqNKULE8wh/PgEuUpK61AfAPaVyO18ZmhSvOvxhvFKq00E5IiFpsl
qgtdXE5G9OsFjpA5ncaMHHS2uSmUKNwkoDlkV9IBgwbcwVhaAq0Dy6kgddugt3Fx
DDJy2bfmjET3tQuCFc6vWtyA2GvahoLtEiZAGO1JBBdjFdlOO0SuZWIhSMnByYm4
QteR+Eqcc0JBBq8DfcmWdbz6CJhHqbgYUodXqO8gO3MY11K6Sg+eSj6Ig7C7Do3X
3NEku7wj0wdVNs/qYXzEPNUuou/aWMTqSOpADmu/1JflWS+ROOjN2VHv/UJ/tZWP
b+Vg9UAQ53ebd5bj8OkPfU5Mqj2e2KIFmjqgOFHQxCB/eH5jMpIDDuxFFMpjv/7n
OOA9uEITX8VU3g4SYY0FqkKcwV8sxfrZ9mcrrUT24Hj0cppOvAoLF8fuMqu6jWBA
WRJ/HLjlu5KIV68ELFU/xCc4z732vGafdBan0QozrJ0CegHw3y2/0wQb6XDbjXqy
lGhC0VjNTGQxE1SufvRsm6UojfsJoTBSMJvNoqpI247hHK6iJig=
=me3V
-----END PGP SIGNATURE-----

--- End Message ---
--- Begin Message --- 
Package: release.debian.org
Version: 13.2

Hi,

The updates referenced in each of these bugs were included in today's
13.2 trixie point release.

Regards,

Adam

--- End Message ---
Reply to: