Version in base suite: 0.19.1-2+deb13u2 Base version: aide_0.19.1-2+deb13u2 Target version: aide_0.19.1-2+deb13u5 Base file: /srv/ftp-master.debian.org/ftp/pool/main/a/aide/aide_0.19.1-2+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/a/aide/aide_0.19.1-2+deb13u5.dsc changelog | 26 +++ patches/0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch | 21 +++ patches/0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch | 67 ++++++++++ patches/series | 2 4 files changed, 116 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_zij7oxp/aide_0.19.1-2+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_zij7oxp/aide_0.19.1-2+deb13u5.dsc: no acceptable signature found diff -Nru aide-0.19.1/debian/changelog aide-0.19.1/debian/changelog --- aide-0.19.1/debian/changelog 2025-11-07 20:33:42.000000000 +0000 +++ aide-0.19.1/debian/changelog 2026-10-22 17:46:48.000000000 +0000 @@ -1,3 +1,29 @@ +aide (0.19.1-2+deb13u5) trixie-security; urgency=medium + + * retry upload a second time + * add upstream patches to fix security issues: + * GHSA-6wc9-4w69-5jc5 + * GHSA-wq25-fm54-5q3q + + -- Marc Haber Thu, 22 Oct 2026 19:46:48 +0200 + +aide (0.19.1-2+deb13u4) trixie-security; urgency=medium + + * retry upload + * add upstream patches to fix security issues: + * GHSA-6wc9-4w69-5jc5 + * GHSA-wq25-fm54-5q3q + + -- Marc Haber Thu, 22 Oct 2026 18:18:51 +0200 + +aide (0.19.1-2+deb13u3) trixie-security; urgency=medium + + * add upstream patches to fix security issues: + * GHSA-6wc9-4w69-5jc5 + * GHSA-wq25-fm54-5q3q + + -- Marc Haber Wed, 21 Oct 2026 17:52:42 +0200 + aide (0.19.1-2+deb13u2) trixie; urgency=medium * fix issue with 31_aide_lvm: bin/buildcache was a non-functional script diff -Nru aide-0.19.1/debian/patches/0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch aide-0.19.1/debian/patches/0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch --- aide-0.19.1/debian/patches/0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch 1970-01-01 00:00:00.000000000 +0000 +++ aide-0.19.1/debian/patches/0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch 2026-10-22 17:46:34.000000000 +0000 @@ -0,0 +1,21 @@ +From: Marc Haber +Date: Wed, 21 Oct 2026 17:47:05 +0200 +Subject: add upstream patch aide-0.19_GHSA-6wc9-4w69-5jc5_bytecmp.patch + +--- + src/gen_list.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/gen_list.c b/src/gen_list.c +index f836440..ffb26ab 100644 +--- a/src/gen_list.c ++++ b/src/gen_list.c +@@ -61,7 +61,7 @@ void fs2db_line(struct stat* fs,db_line* line); + LOG_LEVEL compare_log_level = LOG_LEVEL_COMPARE; + + static int bytecmp(byte *b1, byte *b2, size_t len) { +- return strncmp((char *)b1, (char *)b2, len); ++ return memcmp((char *)b1, (char *)b2, len); + } + + static int has_str_changed(char* old,char* new) { diff -Nru aide-0.19.1/debian/patches/0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch aide-0.19.1/debian/patches/0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch --- aide-0.19.1/debian/patches/0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch 1970-01-01 00:00:00.000000000 +0000 +++ aide-0.19.1/debian/patches/0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch 2026-10-22 17:46:34.000000000 +0000 @@ -0,0 +1,67 @@ +From: Marc Haber +Date: Wed, 21 Oct 2026 17:48:23 +0200 +Subject: add upstream patch aide-0.19_GHSA-wq25-fm54-5q3q_invalid-utf-8.patch + +--- + doc/aide.conf.5 | 6 ++++++ + src/aide.c | 2 +- + src/conf_eval.c | 2 +- + src/seltree.c | 2 +- + 4 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/doc/aide.conf.5 b/doc/aide.conf.5 +index 0b13c82..5e7fa2f 100644 +--- a/doc/aide.conf.5 ++++ b/doc/aide.conf.5 +@@ -480,6 +480,12 @@ against the complete path. + Special characters can be escaped using + two-digit URL encoding (for example, %20 to represent a space). + ++Rules and file names are always treated as single byte sequences (i.e. not as ++UTF strings). That means that multi byte characters aren't matched by single ++dot ('.') or inside a character class. To match UTF multi byte characters, ++explicitly state them in the rule either verbatim (e.g. `®` for registered ++sign) or by hexadecimal escaping (e.g. '\\xC2\\xAE'). ++ + AIDE uses a deepest-match algorithm to find the tree node to search, + but a first-match algorithm inside the node. + (see also \fBrule\fP log level). +diff --git a/src/aide.c b/src/aide.c +index 622e108..aeef53f 100644 +--- a/src/aide.c ++++ b/src/aide.c +@@ -299,7 +299,7 @@ static void read_param(int argc,char**argv) + int len = (strlen(optarg)+1) * sizeof(char); + conf->limit=checked_malloc(len); + strncpy(conf->limit, optarg, len); +- if((conf->limit_crx=pcre2_compile((PCRE2_SPTR) conf->limit, PCRE2_ZERO_TERMINATED, PCRE2_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { ++ if((conf->limit_crx=pcre2_compile((PCRE2_SPTR) conf->limit, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + PCRE2_UCHAR pcre2_error[128]; + pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); + char * limit_safe = stresc(conf->limit); +diff --git a/src/conf_eval.c b/src/conf_eval.c +index 5774ce6..e884569 100644 +--- a/src/conf_eval.c ++++ b/src/conf_eval.c +@@ -597,7 +597,7 @@ static void include_directory(const char* dir, const char* rx, bool execute, cha + PCRE2_SIZE pcre2_erroffset; + pcre2_code* crx; + +- if((crx = pcre2_compile((PCRE2_SPTR) rx, PCRE2_ZERO_TERMINATED, PCRE2_UTF, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { ++ if((crx = pcre2_compile((PCRE2_SPTR) rx, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + PCRE2_UCHAR pcre2_error[128]; + pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); + LOG_CONFIG_FORMAT_LINE(LOG_LEVEL_ERROR, "'%s': error in regular expression '%s' at %zu: %s", execute?"@@x_include":"@@include", rx, pcre2_erroffset, pcre2_error) +diff --git a/src/seltree.c b/src/seltree.c +index 912a2bc..2c623a1 100644 +--- a/src/seltree.c ++++ b/src/seltree.c +@@ -231,7 +231,7 @@ rx_rule * add_rx_to_tree(char * rx, rx_restriction_t restriction, AIDE_RULE_TYPE + int pcre2_errorcode; + PCRE2_SIZE pcre2_erroffset; + +- if((r->crx=pcre2_compile((PCRE2_SPTR) r->rx, PCRE2_ZERO_TERMINATED, PCRE2_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { ++ if((r->crx=pcre2_compile((PCRE2_SPTR) r->rx, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + PCRE2_UCHAR pcre2_error[128]; + pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); + log_msg(LOG_LEVEL_ERROR, "%s:%d:%zu: error in rule '%s': %s (line: '%s')", filename, linenumber, pcre2_erroffset, rx, pcre2_error, linebuf); diff -Nru aide-0.19.1/debian/patches/series aide-0.19.1/debian/patches/series --- aide-0.19.1/debian/patches/series 2025-11-07 20:33:42.000000000 +0000 +++ aide-0.19.1/debian/patches/series 2026-10-22 17:46:34.000000000 +0000 @@ -1,2 +1,4 @@ aide-0.19_cve-2025-54389_control_chars aide-0.19_cve-2025-54409_xattr +0003-add-upstream-patch-aide-0.19_GHSA-6wc9-4w69-5jc5_byt.patch +0004-add-upstream-patch-aide-0.19_GHSA-wq25-fm54-5q3q_inv.patch