XPost: linux.debian.devel.release
This is a multi-part MIME message sent by reportbug.
Package: release.debian.org
Severity: normal
X-Debbugs-Cc:
[email protected]
Control: affects -1 + src:jackrabbit
User:
[email protected]
Usertags: unblock
Please unblock package jackrabbit
[ Reason ]
#1109335
[ Impact ]
Vulnerable for CVE-2025-53689.
[ Tests ]
None.
[ Risks ]
Upstream patch applies cleanly, so there is not a high chance the
program will be affected in a bad way.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
I have fixed this via NMU.
unblock jackrabbit/2.20.11-1.1
diff -Nru jackrabbit-2.20.11/debian/changelog jackrabbit-2.20.11/debian/changelog
--- jackrabbit-2.20.11/debian/changelog 2023-07-29 15:08:48.000000000 +0200
+++ jackrabbit-2.20.11/debian/changelog 2025-07-23 10:05:30.000000000 +0200
@@ -1,3 +1,10 @@
+jackrabbit (2.20.11-1.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Fix CVE-2025-53689 via upstream patch. (Closes: #1109335)
+
+ -- Bastian Germann <
[email protected]> Wed, 23 Jul 2025 10:05:30 +0200
+
jackrabbit (2.20.11-1) unstable; urgency=medium
* Team upload.
diff -Nru jackrabbit-2.20.11/debian/patches/CVE-2025-53689.patch jackrabbit-2.20.11/debian/patches/CVE-2025-53689.patch
--- jackrabbit-2.20.11/debian/patches/CVE-2025-53689.patch 1970-01-01 01:00:00.000000000 +0100
+++ jackrabbit-2.20.11/debian/patches/CVE-2025-53689.patch 2025-07-23 10:05:30.000000000 +0200
@@ -0,0 +1,147 @@
+Origin: upstream, 8ea2349234b181bf790cad58bfd91fd2763e64a9
+From: Julian Reschke <
[email protected]>
+Date: Thu, 10 Jul 2025 18:04:34 +0200
+Subject: JCR-5165: various parsing improvements/consistency (#263)
+
+---