Version in base suite: 0.1.6-1 Base version: xdg-dbus-proxy_0.1.6-1 Target version: xdg-dbus-proxy_0.1.6-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/x/xdg-dbus-proxy/xdg-dbus-proxy_0.1.6-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/x/xdg-dbus-proxy/xdg-dbus-proxy_0.1.6-1+deb13u1.dsc changelog | 11 +++ gbp.conf | 2 patches/Improve-detection-of-eavesdrop-true.patch | 70 ++++++++++++++++++++++ patches/series | 2 4 files changed, 83 insertions(+), 2 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj7aq8tkf/xdg-dbus-proxy_0.1.6-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj7aq8tkf/xdg-dbus-proxy_0.1.6-1+deb13u1.dsc: no acceptable signature found diff -Nru xdg-dbus-proxy-0.1.6/debian/changelog xdg-dbus-proxy-0.1.6/debian/changelog --- xdg-dbus-proxy-0.1.6/debian/changelog 2024-08-22 15:36:07.000000000 +0000 +++ xdg-dbus-proxy-0.1.6/debian/changelog 2026-04-10 22:31:23.000000000 +0000 @@ -1,3 +1,14 @@ +xdg-dbus-proxy (0.1.6-1+deb13u1) trixie-security; urgency=high + + * d/gbp.conf: Configure for trixie + * d/p/Improve-detection-of-eavesdrop-true.patch: + Fix detection of eavesdrop=true match rules, resolving a vulnerability + in which a malicious or compromised Flatpak app could monitor D-Bus + traffic that it was not intended to be able to access. + (CVE-2026-34080) (Closes: #1132939) + + -- Simon McVittie Fri, 10 Apr 2026 23:31:23 +0100 + xdg-dbus-proxy (0.1.6-1) unstable; urgency=medium * Team upload diff -Nru xdg-dbus-proxy-0.1.6/debian/gbp.conf xdg-dbus-proxy-0.1.6/debian/gbp.conf --- xdg-dbus-proxy-0.1.6/debian/gbp.conf 2024-08-22 15:36:07.000000000 +0000 +++ xdg-dbus-proxy-0.1.6/debian/gbp.conf 2026-04-10 22:31:23.000000000 +0000 @@ -1,7 +1,7 @@ [DEFAULT] pristine-tar = True compression = xz -debian-branch = debian/latest +debian-branch = debian/trixie upstream-branch = upstream/latest patch-numbers = False upstream-vcs-tag = %(version)s diff -Nru xdg-dbus-proxy-0.1.6/debian/patches/Improve-detection-of-eavesdrop-true.patch xdg-dbus-proxy-0.1.6/debian/patches/Improve-detection-of-eavesdrop-true.patch --- xdg-dbus-proxy-0.1.6/debian/patches/Improve-detection-of-eavesdrop-true.patch 1970-01-01 00:00:00.000000000 +0000 +++ xdg-dbus-proxy-0.1.6/debian/patches/Improve-detection-of-eavesdrop-true.patch 2026-04-10 22:31:23.000000000 +0000 @@ -0,0 +1,70 @@ +From: Sebastian Wick +Date: Wed, 25 Feb 2026 04:33:50 +0100 +Subject: Improve detection of eavesdrop=true + +While in bus-broker, the eavesdrop match must follow the form of +`eavesdrop=[true|false]`, dbus-broker is more forgiving in its parsing +and also accepts `eavesdrop =[true|false]` and other whitespace (\t\r\n) +between `eavesdrop` and `=`. Let's make sure we also find those cases. + +Origin: upstream, 0.1.7, commit:4d0d1d74d4f40260a79161163b4b2f7276bce0b0 +Bug: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677 +Bug-CVE: CVE-2026-34080 +Bug-Debian: https://bugs.debian.org/1132939 +--- + flatpak-proxy.c | 29 ++++++++++++++++++++++++++--- + 1 file changed, 26 insertions(+), 3 deletions(-) + +diff --git a/flatpak-proxy.c b/flatpak-proxy.c +index 7153135..8a4d597 100644 +--- a/flatpak-proxy.c ++++ b/flatpak-proxy.c +@@ -2108,6 +2108,31 @@ get_arg0_string (Buffer *buffer) + return NULL; + } + ++/* Matches against any "eavesdrop=", "eavesdrop =", etc. in str */ ++static gboolean ++is_eavesdrop (const char *str) ++{ ++ const char *e = str; ++ ++ while (TRUE) ++ { ++ e = strstr (e, "eavesdrop"); ++ if (e == NULL) ++ return FALSE; ++ ++ e += strlen ("eavesdrop"); ++ ++ while (*e == ' '|| ++ *e == '\t' || ++ *e == '\n' || ++ *e == '\r') ++ e++; ++ ++ if (e[0] == '=') ++ return TRUE; ++ } ++} ++ + static gboolean + validate_arg0_match (FlatpakProxyClient *client, Buffer *buffer) + { +@@ -2115,15 +2140,13 @@ validate_arg0_match (FlatpakProxyClient *client, Buffer *buffer) + g_dbus_message_new_from_blob (buffer->data, buffer->size, 0, NULL); + GVariant *body; + g_autoptr(GVariant) arg0 = NULL; +- const char *match; + + if (message != NULL && + (body = g_dbus_message_get_body (message)) != NULL && + (arg0 = g_variant_get_child_value (body, 0)) != NULL && + g_variant_is_of_type (arg0, G_VARIANT_TYPE_STRING)) + { +- match = g_variant_get_string (arg0, NULL); +- if (strstr (match, "eavesdrop=") != NULL) ++ if (is_eavesdrop (g_variant_get_string (arg0, NULL))) + return FALSE; + } + diff -Nru xdg-dbus-proxy-0.1.6/debian/patches/series xdg-dbus-proxy-0.1.6/debian/patches/series --- xdg-dbus-proxy-0.1.6/debian/patches/series 2024-08-22 15:36:07.000000000 +0000 +++ xdg-dbus-proxy-0.1.6/debian/patches/series 2026-04-10 22:31:23.000000000 +0000 @@ -1 +1 @@ - +Improve-detection-of-eavesdrop-true.patch