Version in base suite: 8.10.0-5 Base version: puppet-agent_8.10.0-5 Target version: puppet-agent_8.10.0-5+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/puppet-agent/puppet-agent_8.10.0-5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/p/puppet-agent/puppet-agent_8.10.0-5+deb13u1.dsc changelog | 6 ++ patches/0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch | 23 ++++++++++ patches/series | 1 3 files changed, 30 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprx37_y1n/puppet-agent_8.10.0-5.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprx37_y1n/puppet-agent_8.10.0-5+deb13u1.dsc: no acceptable signature found diff -Nru puppet-agent-8.10.0/debian/changelog puppet-agent-8.10.0/debian/changelog --- puppet-agent-8.10.0/debian/changelog 2025-03-29 13:15:23.000000000 +0000 +++ puppet-agent-8.10.0/debian/changelog 2026-11-04 02:01:24.000000000 +0000 @@ -1,3 +1,9 @@ +puppet-agent (8.10.0-5+deb13u1) trixie-security; urgency=medium + + * d/patches: add patch to fix CVE-2026-115731 + + -- Jérôme Charaoui Tue, 03 Nov 2026 21:01:24 -0500 + puppet-agent (8.10.0-5) unstable; urgency=medium * d/copyright: fix old-fsf-address lintian warning diff -Nru puppet-agent-8.10.0/debian/patches/0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch puppet-agent-8.10.0/debian/patches/0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch --- puppet-agent-8.10.0/debian/patches/0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch 1970-01-01 00:00:00.000000000 +0000 +++ puppet-agent-8.10.0/debian/patches/0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch 2026-11-04 02:01:24.000000000 +0000 @@ -0,0 +1,23 @@ +Description: Fix CVE-2026-115731: Report Deserialization Code Execution +Author: Jérôme Charaoui +Origin: other, https://github.com/overlookinfra/openvox-security-patches/blob/main/scripts/GHSA-ffr6-rwpm-p5wq-Authenticated-RCE-on-Puppet-server-via-Event-Deserialization.sh#L379-L394 +Forwarded: not-needed + +Index: puppet-agent/lib/puppet/transaction/event.rb +=================================================================== +--- puppet-agent.orig/lib/puppet/transaction/event.rb ++++ puppet-agent/lib/puppet/transaction/event.rb +@@ -68,10 +68,9 @@ class Puppet::Transaction::Event + alias == eql? + + def initialize_from_hash(data) +- data = Puppet::Pops::Serialization::FromDataConverter.convert(data, { +- :allow_unresolved => true, +- :loader => Puppet::Pops::Loaders.static_loader +- }) ++ # Read with the stringifying converter, the same one #to_data_hash writes with. ++ # Event values contain no rich data downstream, so there is nothing to reconstruct. ++ data = Puppet::Pops::Serialization::ToStringifiedConverter.convert(data, :message_prefix => 'Event') + @audited = data['audited'] + @property = data['property'] + @previous_value = data['previous_value'] diff -Nru puppet-agent-8.10.0/debian/patches/series puppet-agent-8.10.0/debian/patches/series --- puppet-agent-8.10.0/debian/patches/series 2025-03-29 13:15:23.000000000 +0000 +++ puppet-agent-8.10.0/debian/patches/series 2026-11-04 02:01:24.000000000 +0000 @@ -4,3 +4,4 @@ 0004-Fix-manpages.patch 0005-Relax-getoptlong-version-requirement.patch 0006-Improve-manpage-reproducibility.patch +0007-Fix-CVE-2026-115731-Report-Deserialization-Code-Execution.patch