-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Mar 2026 16:52:10 +0200 Source: inetutils Binary: inetutils-ftp inetutils-ftp-dbgsym inetutils-ftpd inetutils-ftpd-dbgsym inetutils-inetd inetutils-inetd-dbgsym inetutils-ping inetutils-ping-dbgsym inetutils-syslogd inetutils-syslogd-dbgsym inetutils-talk inetutils-talk-dbgsym inetutils-talkd inetutils-talkd-dbgsym inetutils-telnet inetutils-telnet-dbgsym inetutils-telnetd inetutils-telnetd-dbgsym inetutils-tools inetutils-tools-dbgsym inetutils-traceroute inetutils-traceroute-dbgsym Architecture: arm64 Version: 2:2.4-2+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: arm Build Daemon (arm-conova-02) Changed-By: Guillem Jover Description: inetutils-ftp - File Transfer Protocol client inetutils-ftpd - File Transfer Protocol server inetutils-inetd - internet super server inetutils-ping - ICMP echo tool inetutils-syslogd - system logging daemon inetutils-talk - talk to another user inetutils-talkd - remote user communication server inetutils-telnet - telnet client inetutils-telnetd - telnet server inetutils-tools - base networking utilities (experimental package) inetutils-traceroute - trace the IPv4 route to another host Closes: 1130741 1130742 Changes: inetutils (2:2.4-2+deb12u3) bookworm-security; urgency=high . * Add patch from upstream: - Prevent privilege escalation via telnetd abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. Reported by Ron Ben Yizhak . Fixes CVE-2026-28372. - Ignore all environment options from clients unless the variable was listed in the new --accept-env telnetd option. This mitigates privilege escalation using environment variables. This is the complete fix for CVE-2026-24061, with its own CVE pending. - Fix stack buffer overflow processing SLC suboption triplets. Reported by Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel at DREAM Security Research Team. Fixes CVE-2026-32746. (Closes: #1130742) * Add the hashcode-string1 module from forky/sid gnulib adapted to bookworm required by the --accept-env patch, and the gl_hash_set, gl_set, gl_xset and gl_anyhash bookworm gnulib modules required by hashcode-string1. Inject new gnulib modules in lib/Makefile.am. * Adapt netkit-telnet patch to not leak unexported environment variables to telnetd. Reported by Justin Swartz . Fixes CVE-2026-32772. (Closes: #1130741) * Prevent user local privilege escalation using --debug, which was susceptible to symlink attacks, or leaking on-wire credentials to a user that had pre-created the file and kept it open. Fix by switching from /tmp/telnet.debug to /run/telnet/debug., and making the setup error checks fatal. Partially reported by Justin Swartz . * Update local telnetd man page to match new --debug behavior. Checksums-Sha1: 3cd1ed7d006d828c9ddd2118e7417e7557920797 153164 inetutils-ftp-dbgsym_2.4-2+deb12u3_arm64.deb 4d7f55f366ec46af7cf824734f60df3d6dcc4a24 102624 inetutils-ftp_2.4-2+deb12u3_arm64.deb 0d774b0eeccb3f85ac27f25f244f897c86e560d3 185140 inetutils-ftpd-dbgsym_2.4-2+deb12u3_arm64.deb d7faf0eb9a261a819bc340a6040dcb95997fee49 103544 inetutils-ftpd_2.4-2+deb12u3_arm64.deb 6a882f5212ad45e180e9271d084892da5f37a352 103772 inetutils-inetd-dbgsym_2.4-2+deb12u3_arm64.deb f648dc82f5fabfd0fe863418de1995410db39f56 79104 inetutils-inetd_2.4-2+deb12u3_arm64.deb 8844b8658a8251e4b64154ab02eb5ebf87dfaeaa 194376 inetutils-ping-dbgsym_2.4-2+deb12u3_arm64.deb 058153fa16de769a0291426ae9204432113a5a81 84588 inetutils-ping_2.4-2+deb12u3_arm64.deb 22b4e08eef1264442c84c43261a4aaee2f253539 110696 inetutils-syslogd-dbgsym_2.4-2+deb12u3_arm64.deb ae894cc800963b24e8fd12feca2a1c1e33840851 82032 inetutils-syslogd_2.4-2+deb12u3_arm64.deb 80ee562f5100e114a62fea6c8ae3280742178049 84824 inetutils-talk-dbgsym_2.4-2+deb12u3_arm64.deb 6bac14a7ea43f8d4cacf0261326b754fc4c31fd8 68008 inetutils-talk_2.4-2+deb12u3_arm64.deb 63a28ed540101f8844d0d0fda8dc583ad24f6e77 100356 inetutils-talkd-dbgsym_2.4-2+deb12u3_arm64.deb 6a398f8554a4ae53b8e5e94fdacb4fe59d4f5bcd 71016 inetutils-talkd_2.4-2+deb12u3_arm64.deb 368abd648e930ad779e1db08ff432c85060aea77 202380 inetutils-telnet-dbgsym_2.4-2+deb12u3_arm64.deb 55a4e17281f58319c144b861e205930372c5b12c 115812 inetutils-telnet_2.4-2+deb12u3_arm64.deb 442e626472a3d1fe945992e44871778f4737c6de 180472 inetutils-telnetd-dbgsym_2.4-2+deb12u3_arm64.deb cd754c1c7a4252317314ff98138fe284a835a30a 103440 inetutils-telnetd_2.4-2+deb12u3_arm64.deb d5381c905b019c4c7356792f5c10fddb6b20963f 347204 inetutils-tools-dbgsym_2.4-2+deb12u3_arm64.deb fd240489e7326433f6df947cd969a61b5ef107d8 98240 inetutils-tools_2.4-2+deb12u3_arm64.deb a4b43c8f27a1403a1653ad7a9220548565c80bd1 84824 inetutils-traceroute-dbgsym_2.4-2+deb12u3_arm64.deb 7017f7f41e321f45203da1cb0df06226b746160d 65924 inetutils-traceroute_2.4-2+deb12u3_arm64.deb 83c0682f7f43014c487fd846d9cb10866fe7177f 13155 inetutils_2.4-2+deb12u3_arm64-buildd.buildinfo Checksums-Sha256: b3465104004b436abf18fd2662c307795b28bf377e90ae93e1d9243528f12feb 153164 inetutils-ftp-dbgsym_2.4-2+deb12u3_arm64.deb 4e637cf5e2a84e8a1fac1e6cb6751989e11b44800092a933cc82a440d2943bc2 102624 inetutils-ftp_2.4-2+deb12u3_arm64.deb d28ef6a5fac9de9312b55f29ea11bed582a59130b020ba462909a683fc6a13be 185140 inetutils-ftpd-dbgsym_2.4-2+deb12u3_arm64.deb 474b048cde2774d300cfbcf232e3a037641231bebc4625db28fc47036611ffeb 103544 inetutils-ftpd_2.4-2+deb12u3_arm64.deb 89d435ede3742ac0ac06cdad02ea6ceef731c857f02055a959747aa347deb72a 103772 inetutils-inetd-dbgsym_2.4-2+deb12u3_arm64.deb 4c110d50fe45607983a5e8ec3442674aa1a8b3992bfb21954f717b1b0694dabc 79104 inetutils-inetd_2.4-2+deb12u3_arm64.deb 4d0fb96cdd165822d1d94a01013955e8de670c31c679a46955f305113ca17297 194376 inetutils-ping-dbgsym_2.4-2+deb12u3_arm64.deb 4c597d55b472f20d35413d62cab0a99da9d616a83a3598d142732f8ae6155d00 84588 inetutils-ping_2.4-2+deb12u3_arm64.deb 7fa728e52cc8790ff11c280f7e2e9b7071b4f28ce11b9984271c8fc8f303724a 110696 inetutils-syslogd-dbgsym_2.4-2+deb12u3_arm64.deb 6eef1541154ebcaa1d26e3e911cd928902a1c914058d378b7e331818edb296ec 82032 inetutils-syslogd_2.4-2+deb12u3_arm64.deb f763e543f8b04d2048c2164bf911cbcd7b864662acd9cce48c41576a725dc4a4 84824 inetutils-talk-dbgsym_2.4-2+deb12u3_arm64.deb 8f460fcd38a2a291172caf224a00a11bb62b0acd33cd25b8501c23779924d624 68008 inetutils-talk_2.4-2+deb12u3_arm64.deb 61082a5826e426f075a78ccedbbc31449a137ff21909e38631b90ce32b438f9d 100356 inetutils-talkd-dbgsym_2.4-2+deb12u3_arm64.deb a5fd0999f33d0190012af1176ccd384abb017797f793ab4a6ac4be091a78071b 71016 inetutils-talkd_2.4-2+deb12u3_arm64.deb 8995df663aec3e768799b8789ac80639554244b1c399e2bdc03c0d637a1a57c4 202380 inetutils-telnet-dbgsym_2.4-2+deb12u3_arm64.deb 51c0f0088d92744541e897ecab536b1c4c82e32d5c2218e19201aff0d3b8d396 115812 inetutils-telnet_2.4-2+deb12u3_arm64.deb 76b01c8db8609b9abd31f813cef30cf49f5eb872450f0f59c7cb5d283dd1576a 180472 inetutils-telnetd-dbgsym_2.4-2+deb12u3_arm64.deb 348606000650489e66f8843755ed4615f175da8bd9ac345e42f4eef0e0330924 103440 inetutils-telnetd_2.4-2+deb12u3_arm64.deb 375d08f8e708cdbfab37e39191428fe60e45db59fb49da10a9d72f8cd9a9e37d 347204 inetutils-tools-dbgsym_2.4-2+deb12u3_arm64.deb e861eb29bea3cf0376c405f66c69afc7001f2dcc4b198e84ecfd018e19abef2c 98240 inetutils-tools_2.4-2+deb12u3_arm64.deb e6cae3e7d0f27ae7faefa6fb833956e2e2b2cc84626b225478c8e48d773f9780 84824 inetutils-traceroute-dbgsym_2.4-2+deb12u3_arm64.deb f386f9ff56911fe30814f324c4ee7d7e7bd6b2263d3123a4b510dbe6331cfae6 65924 inetutils-traceroute_2.4-2+deb12u3_arm64.deb c5804df69f06f2e320f27688e07604512cefc0614d3d106788a394b34d64e7cf 13155 inetutils_2.4-2+deb12u3_arm64-buildd.buildinfo Files: d46e8dc3ba97cf61f4bc04772def96e8 153164 debug optional inetutils-ftp-dbgsym_2.4-2+deb12u3_arm64.deb 66d7793142de49043f36f7c68658444a 102624 net optional inetutils-ftp_2.4-2+deb12u3_arm64.deb d28017d1a3e395aa106d460a37c22a2d 185140 debug optional inetutils-ftpd-dbgsym_2.4-2+deb12u3_arm64.deb f7bb8c6757f0c21467239b7352f018a1 103544 net optional inetutils-ftpd_2.4-2+deb12u3_arm64.deb c3f364701fcfd5f3fa5f31871fce3530 103772 debug optional inetutils-inetd-dbgsym_2.4-2+deb12u3_arm64.deb 5b3b99d357489143965d0b51e1d6f2f1 79104 net optional inetutils-inetd_2.4-2+deb12u3_arm64.deb 81d4fe976d568fb25bfbe711c1d36d02 194376 debug optional inetutils-ping-dbgsym_2.4-2+deb12u3_arm64.deb 792e6128725d69672a129156b8a694a7 84588 net optional inetutils-ping_2.4-2+deb12u3_arm64.deb 10834e2a73ec8f1aee3057d7081c1f90 110696 debug optional inetutils-syslogd-dbgsym_2.4-2+deb12u3_arm64.deb e41cd265e18214e94497a3f942713228 82032 net optional inetutils-syslogd_2.4-2+deb12u3_arm64.deb 2963a418fe1e8ee3f324ba709442c569 84824 debug optional inetutils-talk-dbgsym_2.4-2+deb12u3_arm64.deb 175af6d07558dff288c1e64b9e9f446a 68008 net optional inetutils-talk_2.4-2+deb12u3_arm64.deb e130e7aa90c6129f41d1abc2073f8053 100356 debug optional inetutils-talkd-dbgsym_2.4-2+deb12u3_arm64.deb e62d3202268914c71d7b4bab0a4b527f 71016 net optional inetutils-talkd_2.4-2+deb12u3_arm64.deb c45a06c0304be35c11302c158e3d70cf 202380 debug optional inetutils-telnet-dbgsym_2.4-2+deb12u3_arm64.deb 9949afae91607ff109f398212ab46362 115812 net standard inetutils-telnet_2.4-2+deb12u3_arm64.deb 1f961b8e025c69df2df213b930bf0c42 180472 debug optional inetutils-telnetd-dbgsym_2.4-2+deb12u3_arm64.deb 194298b7feb2d7da06df803097502863 103440 net optional inetutils-telnetd_2.4-2+deb12u3_arm64.deb 01bd5f59f25924b514d60872e637cfa2 347204 debug optional inetutils-tools-dbgsym_2.4-2+deb12u3_arm64.deb ea43673bf8cf65f312094b57b1c5e6af 98240 net optional inetutils-tools_2.4-2+deb12u3_arm64.deb ecc9119c37cb14317c63c60b104d92b2 84824 debug optional inetutils-traceroute-dbgsym_2.4-2+deb12u3_arm64.deb 5c918a84e1e697cf863b78d565a67e63 65924 net optional inetutils-traceroute_2.4-2+deb12u3_arm64.deb 3195cbd6f8a9f2409cc7464328417c44 13155 net optional inetutils_2.4-2+deb12u3_arm64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEWHj9K9pO9l4btbD1OQKMdMnEH5MFAmnL28sACgkQOQKMdMnE H5OMqg//aaIivuYXgnWbJ5uzEbpC+EetLRjSKrj7g9a9cYQ+9lUH+1O3FCNnAWW7 pshC8xRHRkuR30Q0xonDF3Ohh6kCjHL/EMwdNuWgdgfwnfA7EWMR2MTCqIEUjQKb 6HP21woRj3FGnLLAXARmULecwfZZp+cUtnx8lISUHqhb8dx1Im1I72AlfzPcuJc8 yfdZXUX/fPlVTEwW8zsHtmR6WRrzMQxw08cYYvm8K9hyERdqfDoD1AtC/dXtCCHL cP+M1x3Vevuphux+R66bVaJgtICMIbGuaUwaTuTe6yqq0RaJrvtbD58LH8p1Afiz /xOD579BW1A8LC770t5tF0KwfXko/xoQSxhYQI0ROeia+xcdEnINuIu8C/6PBS9i 91c7ZnyVXudP7xQPruQDBlBaTJ8xLnykMIv0WHYHfChd5phVFrjKEm+nt6w7fVFT J1pBsjsJLaS5m7I7rZNcl2xPL+dYuDIDpwcI5fZfbY6uQVYf6SOJMST8gDJdoTsf SyqdTeg5KPqACo6LuQDclbkB57DRI6EpDVSW0kQxbgND6h6UgssPJoX/rU3lCqq8 WPsYG1DiCUT/GYL/UOWFs/hCsWqyTHbcBs4AAOgHMv6klIeC+5zSYdJGfk26w3pY 8Nkv5qcfiW72ncoaKOQk/1xg2lA+1AD3+rgCC8sXwdUI7FIjAbU= =d2K/ -----END PGP SIGNATURE-----