FOSS Activities in July 2026

7-minute read
debian • ubuntu • open-source
debian • ubuntu • monthly

Here’s my monthly but brief update about the activities I’ve done in the FOSS world.

Debian

Whilst I didn’t have much time, here are still a few things that I worked on:

Ubuntu

I joined Canonical to work on Ubuntu full-time back in February 2021.

  • Continued to push for infrastructure improvements:
    • Charming.
    • Artifact signing.
    • Reorganizing cdimage.
    • And so on.
  • Assisted a bunch of folks with my Archive Admin and Release team hats to:
    • Promoting/demoting binaries to/from main.
    • Taking care of package removals and so on.
    • Reviewed the NEW queue.
  • Reviewed quite a lot of MPs, specs, and other people’s work.
  • Mentoring, coaching, and leading the Release Management team.
  • Mid-year break started and it was quite quiet for the last two weeks. I’ll be off the first two weeks in August.

Debian (E)LTS

This month I have worked 48.75 hours on Debian Long Term Support (LTS) and on its sister Extended LTS project and did the following things:

Released Security Updates

  • sympa: Authentication bypass via an arbitrary e-mail address when the generic SSO login feature is enabled.

  • php8.2: Buffer overflow in the AES Key Wrap with Padding implementation in the openssl extension, leading to memory corruption.

  • php-phpseclib: Multiple vulnerabilities - a hostname validation bypass via subjectAltName, two timing side channels, an “OID amplification” denial of service in the ASN.1 decoder, and SSRF via the Authority Information Access extension.

  • wolfssl: Multiple vulnerabilities, including X.509 name-constraint and CRL critical-extension bypasses, PKCS#7 signer confusion and MAC forgeries, and several memory-safety issues.

  • opam: .install file directives were insufficiently restricted; symlink resolution on the target path wasn’t checked, allowing directory traversal out of the package area.

  • squid: Multiple vulnerabilities, which could result in information disclosure or Denial of Service.

Work in Progress

  • phpseclib: The 1.0.x source package, which is a separate source from php-phpseclib above.

  • node-lodash: Following up on DLA 4663-1.

    • [LTS]: We found a non-functional regression in the bullseye upload right at the start of the month and re-uploaded the fix to debusine and was released upon successful testing.
    • [bookworm]: There’s yet another regression there but this time, it’s on upstream. I opened https://github.com/lodash/lodash/security/advisories/GHSA-fppw-337r-45gv to discuss this with upstream and so this will carry-over unfortunately.

Other Activities

  • [E/LTS] Did two front-desk weeks this month, 06-07 to 12-07 and 20-07 to 26-07. The second one wasn’t originally mine - I swapped slots with Thorsten as I was leaving for vacation during the last weekend of July - and it turned out to be the busiest stretch of the month.

    • Across the two weeks I made 391 commits to the LTS and ELTS security trackers - 381 hand-authored plus 10 automated ELTS end-of-life sweeps - triaging 505 unique CVEs across 205 source packages and all four suites.
    • Newly queued 28 source packages - 26 in dla-needed (aom, chromium, clamav, exim4, ffmpeg, gimp, jackson-databind, libass, libde265, libxfont, logback, lrzip, opam, openimageio, py7zr, python-authlib, python-geopandas, python-git, python-httplib2, python-msgpack, redis, roundcube, ruby-oj, shiro, swift, and tiff) and 12 in ela-needed (clamav, gimp, gsasl, libass, libde265, libxfont, python-httplib2, python-msgpack, python-tornado, redis, ruby-oj, and tiff), 10 of them in both. Also widened 12 existing entries from a single suite to the whole tier - bind9, busybox, calibre, docker-registry, ffmpeg, ldap-account-manager, libcryptx-perl, libsoup2.4, python-tornado, and snapd on the LTS side, exim4 and ffmpeg on the ELTS one.
    • Most of the interesting work sat in the <not-affected> verdicts: 213 of 269 (79%, across 65 packages) rest on proving the vulnerable construct simply isn’t in the source we ship, rather than on trusting upstream’s affected-version range. Another 24 lines came from bundled or embedded libraries being out of scope - node-ajv uses uri-js and not the vulnerable fast-uri, jansi1 ships no native code, ruby-oj’s flaw is JRuby-only, mina/mina2 don’t ship the vulnerable sshd modules - and 10 from build configuration, e.g. curl is built --without-libssh, and there’s no libopenjp2-7-dev in pillow’s Build-Depends before bookworm, so the affected decoder isn’t compiled in at all.
    • On the other side, 75 <end-of-life> lines, 72 of them in bookworm - lxd (28 CVEs), mbedtls (16), php-horde-imp, and php-horde-vfs - plus python2.7 in bullseye and golang-x-text in stretch. And some tracker hygiene: merged a stale RUSTSEC placeholder into the rust-quinn-proto entry, answered a long-standing hdf5 TODO about the array datatype decode, and flagged six entries where I reckon the Security team’s trixie triage is off (rtklib, node-axios, openimageio, docker-registry, python3.9/python3.11, and the plainly wrong CNA text on CVE-2026-15308) to raise as one batch rather than acting on them unilaterally.
    • I even helped the Debian Security team in correcting a couple of their triages. We had exchanges over the mail.

  • [LTS] Followed up on the wolfssl end-of-life question on the mailing list. Upstream offered to keep patching the 5.5.4 branch for bookworm, and my position was that end-of-life status and occasional opportunistic fixes can happily coexist - we should let it run over a few updates before considering flipping wolfssl back to limited-support, so we don’t reverse an EOL decision we can’t actually stand behind. Thread here.

  • [LTS] Reviewed Christopher’s flask work for CVE-2026-27205 and flagged flask-socketio as a fresh regression in the reverse-dependency results before the upload went out. Thread here.

  • [E/LTS] Wrapped up my end of the security tracker repository size investigation from last month - ran the benchmarks on my own machine to satisfy myself the numbers held up, and then happily deferred to Sylvain, Helmut, and Santiago, who’d already put a lot more time into it and documented the workarounds. Thread here.

  • [E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.

  • [E/LTS] Attended the monthly LTS meeting on IRC. Meeting notes here.

Until next time.
:wq for today.