Bug#1065266: bullseye-pu: package php-phpseclib/2.0.30-2+deb11u2

[David Prévot]

Package: release.debian.org
Severity: normal
Tags: bullseye
X-Debbugs-Cc: php-***@packages.debian.org, ***@security.debian.org
Control: affects -1 + src:php-phpseclib
User: ***@packages.debian.org
Usertags: pu

Hi,

This issue is similar to #1065263 for bookworm

I’d like to see CVE-2024-27354 and CVE-2024-27355 addressed in the next
point release. We agreed with the security team that these issues are
not worth a DSA.

[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in oldstable
[x] the issue is verified as fixed in unstable

TIA for considering.

Cheers,

taffit

[Debian Bug Tracking System]

Post by David Prévot
affects -1 + src:php-phpseclib

Bug #1065266 [release.debian.org] bullseye-pu: package php-phpseclib/2.0.30-2+deb11u2
Added indication that 1065266 affects src:php-phpseclib

[David Prévot]

Le Sat, Mar 02, 2024 at 11:22:22AM +0100, David Prévot a écrit :
[
]

Post by David Prévot
[x] attach debdiff against the package in oldstable

Second try.

[Jonathan Wiltshire]

Control: tag -1 confirmed

Please go ahead.

Thanks,

[Debian Bug Tracking System]

tag -1 confirmed

Bug #1065266 [release.debian.org] bullseye-pu: package php-phpseclib/2.0.30-2+deb11u2
Added tag(s) confirmed.

[Jonathan Wiltshire]

package release.debian.org
tags 1065266 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: php-phpseclib
Version: 2.0.30-2+deb11u2

Explanation: force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()