XPost: linux.debian.devel.release
Package: release.debian.org
Severity: normal
X-Debbugs-Cc:
[email protected]
Control: affects -1 + src:unbound
User:
[email protected]
Usertags: unblock
Please unblock package unbound
[ Reason ]
There's a single fix from upstream for a security issue,
i#1109427, CVE-2025-5994.
[ Tests ]
I haven't done much testing, though the new package seems
to be working (it is already used in production for our
networks), and it looks like there were no issues found
by other users either.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
Debdiff is below.
Thanks,
/mjt
unblock unbound/1.22.0-2
diff -Nru unbound-1.22.0/debian/changelog unbound-1.22.0/debian/changelog
--- unbound-1.22.0/debian/changelog 2024-10-19 13:11:14.000000000 +0300
+++ unbound-1.22.0/debian/changelog 2025-07-17 19:05:22.000000000 +0300
@@ -1,3 +1,10 @@
+unbound (1.22.0-2) unstable; urgency=medium
+
+ * add Fix-RebirthDay-Attack-CVE-2025-5994.patch from upstream
+ (Closes: #1109427, CVE-2025-5994)
+
+ -- Michael Tokarev <
[email protected]> Thu, 17 Jul 2025 19:05:22 +0300
+
unbound (1.22.0-1) unstable; urgency=medium
* new upstream release (1.22.0)
diff -Nru unbound-1.22.0/debian/patches/Fix-RebirthDay-Attack-CVE-2025-5994.patch unbound-1.22.0/debian/patches/Fix-RebirthDay-Attack-CVE-2025-5994.patch
--- unbound-1.22.0/debian/patches/Fix-RebirthDay-Attack-CVE-2025-5994.patch 1970-01-01 03:00:00.000000000 +0300
+++ unbound-1.22.0/debian/patches/Fix-RebirthDay-Attack-CVE-2025-5994.patch 2025-07-17 19:03:46.000000000 +0300
@@ -0,0 +1,278 @@
+From: "W.C.A. Wijngaards" <
[email protected]>
+Date: Wed, 16 Jul 2025 10:02:01 +0200
+Subject: Fix RebirthDay Attack CVE-2025-5994, report