-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 17 Oct 2026 00:17:11 +0300 Source: erlang-hex Architecture: source Version: 2.5.3-1 Distribution: experimental Urgency: medium Maintainer: Debian Erlang Packagers <pkg-erlang-devel@lists.alioth.debian.org> Changed-By: Sergei Golovan <sgolovan@debian.org> Closes: 1150902 Changes: erlang-hex (2.5.3-1) experimental; urgency=medium . * Team upload. * New upstream release. - Fix CVE-2026-105274: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). Closes: #1150902. - Fix CVE-2026-103503: Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. - Fix CVE-2026-105280: Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. - Fix CVE-2026-105668: Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. - Fix CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. - Fix CVE-2026-96612: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. - Fix CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. * Bump debhelper compatibility level to 14. Checksums-Sha1: f836776718bf25c94698363e2f766367b2aff788 1936 erlang-hex_2.5.3-1.dsc b4e7b7a0961d1098607980f4e100f6a5762c245d 610397 erlang-hex_2.5.3.orig.tar.gz 8055e9d5c234a33196cbc4cb0a346d402ab6e857 3976 erlang-hex_2.5.3-1.debian.tar.xz 43716abf0ec50a7213d1a6605cce671b2bc48620 6064 erlang-hex_2.5.3-1_amd64.buildinfo Checksums-Sha256: 4068b4079702d808f078fcf2d6ffb9c246ba37ae0c53f4c7930b7e5ced3236a8 1936 erlang-hex_2.5.3-1.dsc 763398d6aa2a3a969d156b1ff74ff59f4be36484023b3e0a25fae524ed0f2213 610397 erlang-hex_2.5.3.orig.tar.gz c9ec95697a80d246f5fbe0f2d8aea10cbe3052fa4ba70e23ef0bb8ee0c1681f7 3976 erlang-hex_2.5.3-1.debian.tar.xz 0598f9c7c6b72ab3940da1cd335c80354a1c94c2c65d0379cb78532aa209c59d 6064 erlang-hex_2.5.3-1_amd64.buildinfo Files: fd94f32a638e9e2b220e9f09a282c157 1936 interpreters optional erlang-hex_2.5.3-1.dsc 328389e56811a8d94c58712318fa8555 610397 interpreters optional erlang-hex_2.5.3.orig.tar.gz 1fe919b3d464e08af06eb333451dfe7f 3976 interpreters optional erlang-hex_2.5.3-1.debian.tar.xz 927b58942e87080cad64718fe7159e7b 6064 interpreters optional erlang-hex_2.5.3-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmrSlVUACgkQTyrk60tj 54ec2xAAmFgYKC101BI8hTKKiItI/HTVAyYOajCUKvoz+2S49ZiA4oUcuUhwV0ND fhD58va2g1pyEA0gc2IEjBDhDU1YcIuyym/ndC+i8ZCAR/rqHEmxF4jAv5WOPVRt mgK+34ACt8Bevo13pKWn7bnFm4Zihh6f7mR/k2132sfKlb+Vci9EJkHX1sMsG5RD B2XF+FUstiRCfWg81PEaK9h9Pli8lvjns2XV4olHSCepQLOWwqXkiZnWEIymxbbK QdY7dW7LmLysGT3WGkFDttaxCbdOpBUmid7x82zFgEEG7Bd12F3PEeIRlUf2f/zA tdhGXPpboH4R0TrLjiYxwGjGrjEFj2CBuUrAFqH3LdmkojGNWaRhSqKYnCtKiLiT PE4CJUAaS7/EqQR+qU9Boj0Hv1LEsn/3iZwzOsePvJqaXq9eXEVmKMcXXND5JecT fMZp8FrDe4H8tPgA+GkvwoQ82W9BjB+hVT+/QIqYLcyWBWxciqLFCodHukGHcN0e XMv/qN+eZ0nJoUYAlDi0d+4z570HiY7IBmBk4Y4s0/jTl1arEKPype8S5x6Zyaze JF+owbVOMemlsopE3mTuTBRbJi70Oa8mbzvdKrJLRNwjySu5oSlAvFdniw5cYEde ZtAlvPC6RKqRucTopav1KMGvaFl3R56DFJAJkHdzE9r1nY1/hbE= =psWe -----END PGP SIGNATURE-----
