rex - Debian Package Tracker

general

source: rex (main)
version: 1.16.1-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: Alexandre Mestiashvili (DMD)
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.13.3-1
oldstable: 1.14.1-1
stable: 1.16.0-1
testing: 1.16.1-1
unstable: 1.16.1-1

versioned links

1.13.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

Created: 2026-10-22 Last update: 2026-11-03 11:30

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

Created: 2026-10-22 Last update: 2026-11-03 11:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.16.1-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 65962c4681c4e28e0fd9f78229a430193ad8dc29
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 18:50:48 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 22f4504de2a284a5150a5dd3ea0f518c974e5ffe
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 18:50:48 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-08 19:03

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-94140: (needs triaging) Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-10-22 Last update: 2026-11-03 11:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-10-06] rex 1.16.1-1 MIGRATED to testing (Debian testing watch)
[2025-10-03] Accepted rex 1.16.1-1 (source) into unstable (gregor herrmann)
[2025-09-18] rex 1.16.0-2 MIGRATED to testing (Debian testing watch)
[2025-09-15] Accepted rex 1.16.0-2 (source) into unstable (gregor herrmann)
[2025-02-10] rex 1.16.0-1 MIGRATED to testing (Debian testing watch)
[2025-02-07] Accepted rex 1.16.0-1 (source) into unstable (gregor herrmann)
[2024-11-19] rex 1.15.0-1 MIGRATED to testing (Debian testing watch)
[2024-11-17] Accepted rex 1.15.0-1 (source) into unstable (gregor herrmann)
[2023-08-14] rex 1.14.3-1 MIGRATED to testing (Debian testing watch)
[2023-08-09] Accepted rex 1.14.3-1 (source) into unstable (gregor herrmann)
[2023-06-18] rex 1.14.2-1 MIGRATED to testing (Debian testing watch)
[2023-06-11] Accepted rex 1.14.2-1 (source) into unstable (gregor herrmann)
[2023-03-27] rex 1.14.1-1 MIGRATED to testing (Debian testing watch)
[2023-03-06] Accepted rex 1.14.1-1 (source) into unstable (gregor herrmann)
[2023-02-09] rex 1.14.0-1 MIGRATED to testing (Debian testing watch)
[2023-02-06] Accepted rex 1.14.0-1 (source) into unstable (gregor herrmann)
[2021-10-01] rex 1.13.4-1 MIGRATED to testing (Debian testing watch)
[2021-09-28] Accepted rex 1.13.4-1 (source) into unstable (gregor herrmann)
[2021-03-26] rex 1.13.3-1 MIGRATED to testing (Debian testing watch)
[2021-03-05] Accepted rex 1.13.3-1 (source) into unstable (gregor herrmann)
[2020-12-08] rex 1.13.2-1 MIGRATED to testing (Debian testing watch)
[2020-12-06] Accepted rex 1.13.2-1 (source) into unstable (gregor herrmann)
[2020-11-11] rex 1.13.1-1 MIGRATED to testing (Debian testing watch)
[2020-11-08] Accepted rex 1.13.1-1 (source) into unstable (gregor herrmann)
[2020-10-08] rex 1.13.0-1 MIGRATED to testing (Debian testing watch)
[2020-10-06] Accepted rex 1.13.0-1 (source) into unstable (Alexandre Mestiashvili)
[2020-09-18] Accepted rex 1.12.2-1~bpo10+1 (source) into buster-backports (Alexandre Mestiashvili)
[2020-09-10] rex 1.12.2-1 MIGRATED to testing (Debian testing watch)
[2020-09-07] Accepted rex 1.12.2-1 (source) into unstable (gregor herrmann)
[2020-08-09] rex 1.12.1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.16.1-1