Version in base suite: 2.0.1-2 Base version: trapperkeeper-authorization-clojure_2.0.1-2 Target version: trapperkeeper-authorization-clojure_2.0.1-2+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/trapperkeeper-authorization-clojure/trapperkeeper-authorization-clojure_2.0.1-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/trapperkeeper-authorization-clojure/trapperkeeper-authorization-clojure_2.0.1-2+deb13u1.dsc /srv/release.debian.org/tmp/1PDRcdbDnH/trapperkeeper-authorization-clojure-2.0.1/debian/patches/0003-Fix-CVE-2026-115732\342\200\223Certificate-Name-Authorization-Bypass.patch | 41 ++++++++++ trapperkeeper-authorization-clojure-2.0.1/debian/changelog | 6 + trapperkeeper-authorization-clojure-2.0.1/debian/patches/series | 1 3 files changed, 48 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpx74ejhtu/trapperkeeper-authorization-clojure_2.0.1-2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpx74ejhtu/trapperkeeper-authorization-clojure_2.0.1-2+deb13u1.dsc: no acceptable signature found diff -Nru trapperkeeper-authorization-clojure-2.0.1/debian/changelog trapperkeeper-authorization-clojure-2.0.1/debian/changelog --- trapperkeeper-authorization-clojure-2.0.1/debian/changelog 2025-03-24 21:31:58.000000000 +0000 +++ trapperkeeper-authorization-clojure-2.0.1/debian/changelog 2026-11-04 02:50:29.000000000 +0000 @@ -1,3 +1,9 @@ +trapperkeeper-authorization-clojure (2.0.1-2+deb13u1) trixie-security; urgency=medium + + * d/patches: add patch to fix CVE-2026-115732 + + -- Jérôme Charaoui Tue, 03 Nov 2026 21:50:29 -0500 + trapperkeeper-authorization-clojure (2.0.1-2) unstable; urgency=medium * d/patches: fix error message matching test (Closes: #1100326) diff -Nru "/srv/release.debian.org/tmp/ShZMD7Cr29/trapperkeeper-authorization-clojure-2.0.1/debian/patches/0003-Fix-CVE-2026-115732\342\200\223Certificate-Name-Authorization-Bypass.patch" "/srv/release.debian.org/tmp/1PDRcdbDnH/trapperkeeper-authorization-clojure-2.0.1/debian/patches/0003-Fix-CVE-2026-115732\342\200\223Certificate-Name-Authorization-Bypass.patch" --- "/srv/release.debian.org/tmp/ShZMD7Cr29/trapperkeeper-authorization-clojure-2.0.1/debian/patches/0003-Fix-CVE-2026-115732\342\200\223Certificate-Name-Authorization-Bypass.patch" 1970-01-01 00:00:00.000000000 +0000 +++ "/srv/release.debian.org/tmp/1PDRcdbDnH/trapperkeeper-authorization-clojure-2.0.1/debian/patches/0003-Fix-CVE-2026-115732\342\200\223Certificate-Name-Authorization-Bypass.patch" 2026-11-04 02:50:29.000000000 +0000 @@ -0,0 +1,41 @@ +Description: Fix CVE-2026-115732: Certificate Name Authorization Bypass +Author: Jérôme Charaoui +Origin: other, https://github.com/overlookinfra/openvox-security-patches/blob/main/scripts/GHSA-q4hm-33rc-572g-Flawed-Hostname-Check-allows-Puppet-Client-Impersonation.sh#L401-L434 +Forwarded: not-needed + +Index: trapperkeeper-authorization-clojure/src/puppetlabs/trapperkeeper/authorization/acl.clj +=================================================================== +--- trapperkeeper-authorization-clojure.orig/src/puppetlabs/trapperkeeper/authorization/acl.clj ++++ trapperkeeper-authorization-clojure/src/puppetlabs/trapperkeeper/authorization/acl.clj +@@ -79,7 +79,7 @@ + (def ACE + "An authorization entry matching a network or a domain" + {:auth-type AuthType +- :match (schema/enum :string :regex :backreference :extensions :rbac-permission) ++ :match (schema/enum :string :wildcard :regex :backreference :extensions :rbac-permission) + :value ACEValue}) + + (def ACL +@@ -166,7 +166,7 @@ + (re-matches #"^\*(\.(\w[-\w]*)){1,}$" certname) + (let [host_sans_star (vec (drop-last (split-domain certname)))] + {:auth-type auth-type +- :match :string ++ :match :wildcard + :value host_sans_star}) + + ; backreference +@@ -199,9 +199,10 @@ + [{:keys [value match]} :- ACE + to-match :- schema/Str] + (let [match-split-domain (split-domain to-match)] +- (if (= :regex match) +- (boolean (re-find (re-pattern value) to-match)) +- (every? (fn [[a b]] (= a b)) (map vector value match-split-domain))))) ++ (case match ++ :regex (boolean (re-find (re-pattern value) to-match)) ++ :wildcard (= value (take (count value) match-split-domain)) ++ (= value match-split-domain)))) + + (schema/defn ^:private substitute-backreference :- schema/Str + "substiture $1, $2... by the same index in the captures vector" diff -Nru trapperkeeper-authorization-clojure-2.0.1/debian/patches/series trapperkeeper-authorization-clojure-2.0.1/debian/patches/series --- trapperkeeper-authorization-clojure-2.0.1/debian/patches/series 2025-03-24 21:31:58.000000000 +0000 +++ trapperkeeper-authorization-clojure-2.0.1/debian/patches/series 2026-11-04 02:50:29.000000000 +0000 @@ -1,2 +1,3 @@ 0001_Lein_Local.patch 0002_Fix_test_for_modified_error_message_with_new_Bouncy_Castle.patch +0003-Fix-CVE-2026-115732–Certificate-Name-Authorization-Bypass.patch