Version in base suite: 1.3.1-1 Base version: packagekit_1.3.1-1 Target version: packagekit_1.3.1-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/packagekit/packagekit_1.3.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/p/packagekit/packagekit_1.3.1-1+deb13u1.dsc changelog | 7 + patches/PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch | 61 ++++++++++ patches/series | 1 3 files changed, 69 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpm7_aq5ik/packagekit_1.3.1-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpm7_aq5ik/packagekit_1.3.1-1+deb13u1.dsc: no acceptable signature found diff -Nru packagekit-1.3.1/debian/changelog packagekit-1.3.1/debian/changelog --- packagekit-1.3.1/debian/changelog 2025-04-22 20:18:16.000000000 +0000 +++ packagekit-1.3.1/debian/changelog 2026-04-21 14:45:57.000000000 +0000 @@ -1,3 +1,10 @@ +packagekit (1.3.1-1+deb13u1) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * Do not allow re-invoking methods on non-new transactions + + -- Salvatore Bonaccorso Tue, 21 Apr 2026 16:45:57 +0200 + packagekit (1.3.1-1) unstable; urgency=medium [ Matthias Klumpp ] diff -Nru packagekit-1.3.1/debian/patches/PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch packagekit-1.3.1/debian/patches/PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch --- packagekit-1.3.1/debian/patches/PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch 1970-01-01 00:00:00.000000000 +0000 +++ packagekit-1.3.1/debian/patches/PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch 2026-04-21 14:45:57.000000000 +0000 @@ -0,0 +1,61 @@ +From 22656f21232702439bc6b7d10bb7ac65253b5e8d Mon Sep 17 00:00:00 2001 +From: Matthias Klumpp +Date: Tue, 14 Apr 2026 16:12:18 +0200 +Subject: [PATCH] Do not allow re-invoking methods on non-new transactions + +This ensures that cached parameters (such a transaction flags) can not +be changed on an already running transaction or a transaction that is +waiting for authorization. + +It also prevents backwards state transitions in case a client +misbehaves. +[Salvatore Bonaccorso: Backport changes to version before fce95c935347 +("trivial: typos") in v1.3.3] +--- + src/pk-transaction.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/src/pk-transaction.c b/src/pk-transaction.c +index db64aab8f..82501b56f 100644 +--- a/src/pk-transaction.c ++++ b/src/pk-transaction.c +@@ -5250,14 +5250,32 @@ pk_transaction_method_call (GDBusConnection *connection_, const gchar *sender, + pk_transaction_set_hints (transaction, parameters, invocation); + return; + } +- if (g_strcmp0 (method_name, "AcceptEula") == 0) { +- pk_transaction_accept_eula (transaction, parameters, invocation); +- return; +- } + if (g_strcmp0 (method_name, "Cancel") == 0) { + pk_transaction_cancel (transaction, parameters, invocation); + return; + } ++ ++ /* All action methods below must only be invoked once on a new transaction. ++ * Reject any attempt to re-invoke them after the transaction has been initialized, ++ * preventing situations where a second D-Bus call could overwrite transaction flags ++ * (or other cached state) after authorization has already been granted for the previous ++ * request based on the old parameters. */ ++ if (transaction->priv->state != PK_TRANSACTION_STATE_NEW) { ++ g_dbus_method_invocation_return_error (invocation, ++ PK_TRANSACTION_ERROR, ++ PK_TRANSACTION_ERROR_INVALID_STATE, ++ "cannot call %s on transaction %s: " ++ "already in state %s", ++ method_name, ++ transaction->priv->tid, ++ pk_transaction_state_to_string (transaction->priv->state)); ++ return; ++ } ++ ++ if (g_strcmp0 (method_name, "AcceptEula") == 0) { ++ pk_transaction_accept_eula (transaction, parameters, invocation); ++ return; ++ } + if (g_strcmp0 (method_name, "DownloadPackages") == 0) { + pk_transaction_download_packages (transaction, parameters, invocation); + return; +-- +2.53.0 + diff -Nru packagekit-1.3.1/debian/patches/series packagekit-1.3.1/debian/patches/series --- packagekit-1.3.1/debian/patches/series 2025-04-22 20:18:16.000000000 +0000 +++ packagekit-1.3.1/debian/patches/series 2026-04-21 14:45:23.000000000 +0000 @@ -1 +1,2 @@ policy.diff +PK_Do-not-allow-re-invoking-methods-on-non-new-txn.patch