Hi

https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp

Regards,
Salvatore

Hi Salvatore

actually upstream marked both CVEs as fixed in 2.6.4:
TEMP-1139716-6892B6
TEMP-1139717-36B614

I uploaded 2.6.4 to unstable, so at least sid and testing will be fixed.
Unfortunately the diff between 2.6.3 and 2.6.4 is quite big :( So I'm currently
investigating the source, if I can extract the patches to fix the CVEs.

Thanks for all your work!

Regards,

hefee

We believe that the bug you reported is fixed in the latest version of
onionshare, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139716@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sandro Knauß <hefee@debian.org> (supplier of updated onionshare package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 10 Jul 2026 18:23:18 +0200
Source: onionshare
Architecture: source
Version: 2.6.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Privacy Tools Maintainers <pkg-privacy-maintainers@lists.alioth.debian.org>
Changed-By: Sandro Knauß <hefee@debian.org>
Closes: 1139716 1139717
Changes:
 onionshare (2.6.4-1) unstable; urgency=medium
 .
   * New upstream release.
     - Fixes TEMP-1139717-36B614 (Closes: #1139717)
     - Fixes TEMP-1139716-6892B6 (Closes: #1139716)
   * Switch to debhelper 14.
   * Update jquery from 3.5.1 to 3.7.1.
   * Update socket.io to 4.8.3.
   * Update copyright to match updated sources.
   * Update debian patches.
   * Update lintian-overrides.
Checksums-Sha1:
 970f219e8d60dcba5fe75bb3986f5a0bb7f345a8 2993 onionshare_2.6.4-1.dsc
 372db1c6b9083dfb8a36840b2c29d9ef3ece9e13 8994163 onionshare_2.6.4.orig.tar.gz
 65821aaab9d8ca865f0c2ef0b3dd2c3e31829543 101900 onionshare_2.6.4-1.debian.tar.xz
Checksums-Sha256:
 b244c51f2224c1f9d292dd3ef3a842d1a9614ae9ca18e7f662a79353f84b3c58 2993 onionshare_2.6.4-1.dsc
 94b8e87d325a48b8e7c9eb53dbe2779d76e0b32dccb68267e86c8a18149968a1 8994163 onionshare_2.6.4.orig.tar.gz
 d4f91f9f5773cd2347a46adcde7c95a245dd69c4635c02b59bb71442d6df5a70 101900 onionshare_2.6.4-1.debian.tar.xz
Files:
 63161d82a3ad06f49e7865545a19754e 2993 net optional onionshare_2.6.4-1.dsc
 917094e28452e74339f819b0e528c98f 8994163 net optional onionshare_2.6.4.orig.tar.gz
 41937661ee5f3d1fcfcb64866dfbf43a 101900 net optional onionshare_2.6.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEOewRoCAWtykmSRoG462wCFBgVjYFAmpRHRoRHGhlZmVlQGRl
Ymlhbi5vcmcACgkQ462wCFBgVjYEaA/8DDnBoaM8J9AOSMjBg4AimEMLaiFZGCA/
c8rUHRL0xLrxx6caGQmy3KN/byZUCI5/o8mBr8GNMdYvuBvZeln4voWyd0S51ay4
GdvMbCGF+HJqbL1g9pRpuVe8My96RJZTU5cYm0HhEGXd9pVBpjVL9YkKByvvJ8vd
o/nynlnkJzJEF7NqQ2tyTtBM19DIlr5Ihf9yihQwK/FQiK1cG04fCajZFaAWw1Ka
0f939aFAIIx+oAF8M93mrmcX/dEuchC8Tigv1Typ+QXOrJr1wycaFU+eBYFSfhCy
Sc8/waFh4Q0cdU4yhomOOPpPZo86UKuQdL8eqNk4pNzJIiJErtWX0CQPsrmzIcw/
GVxD7Ld23RFYL8U+C6Wj2Iwjaks1kkqbwcVq0FVQBU68/BOTfZ/0Ns5a6yOeBcE5
72iKqzAReFx7FfsA3QqOISoQU1ySWThfczhVEjMnnoChyeQOpmd+bNWLJ82CyF7C
yKyN2WU+NW56BM/nHxlEbxlirI8QGic5+2C07jpI4/J9jGesdzbsqnaBsm1Omyr8
a6KEyFu+DNT9j1jIwLPs717zirXUn9+ucfNfiLye6XXKNkcZ5mZ4n3cPEq3DsY64
YfH87WD8qPLti1TSMtR3M4nWsQ7Rj1EMU5fEo3C9i8nXzOkSyqidvMY9Hqjf1A3/
p1M3GpadorY=
=J50f
-----END PGP SIGNATURE-----

Hi,

Thanks, I have updated the tracker to reflect the status with fixed
version.

for trixie, you see we marked it no-dsa, but if it turns out that it
is becoming too complicated, then a point release update might as well
not be realistic. Let us know how it goes.

Same! Thanks for putting energy into this one here in particular as
well.

Regards,
Salvatore

Hi,

I see that the CVEs now have proper names:

TEMP-1139717-36B614 -> CVE-2026-54706
TEMP-1139716-6892B6 -> CVE-2026-54707

hefee

We believe that the bug you reported is fixed in the latest version of
onionshare, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139716@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sandro Knauß <hefee@debian.org> (supplier of updated onionshare package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 11 Jul 2026 19:28:08 +0200
Source: onionshare
Architecture: source
Version: 2.6.3-1+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: Debian Privacy Tools Maintainers <pkg-privacy-maintainers@lists.alioth.debian.org>
Changed-By: Sandro Knauß <hefee@debian.org>
Closes: 1139716 1139717
Changes:
 onionshare (2.6.3-1+deb13u2) trixie; urgency=medium
 .
   * Use CVE identifiers.
 .
 onionshare (2.6.3-1+deb13u1) trixie; urgency=medium
 .
   * Update debian branch in gbp.conf.
   * Fixes CVE-2026-54707. (Closes: #1139716)
     Backport upstream patches from 2.6.4:
     - a090e97193efc91fbeac9dace7793ea568b83cf5
     - e4ed559908b55cf41b993ed3d02052911025785b
     - 1d76494f5d819adc4c69f08f3842d564a425aa89
   * Fixes CVE-2026-54706. (Closes: #1139717)
     Backport upstream patches from 2.6.4:
     - 48f31cfac077fcc9c04c67c2a6dbf87d956f5eec
     - 96827bdd0580bd34b921a7b269198f65434178d8
     - d0697fa3d05a193138c6052422c313612301d98a
Checksums-Sha1:
 e7866becb12d3c4fca66b70a1b2744882abd01a1 3241 onionshare_2.6.3-1+deb13u2.dsc
 dddb51d8f667cc28622131595a38d8d4c9c969ff 121712 onionshare_2.6.3-1+deb13u2.debian.tar.xz
 d40a18caea8fb69d61f6538ccb52d8672c693db5 10832192 onionshare_2.6.3-1+deb13u2.git.tar.xz
 0abc8c7574b1ed77b4129e45af50b427ff85cebc 17548 onionshare_2.6.3-1+deb13u2_source.buildinfo
Checksums-Sha256:
 88a5b5bfc7b19c0ae85a19ec156af5cca3e3802196216a922cb99fa6b6696ff6 3241 onionshare_2.6.3-1+deb13u2.dsc
 6fe50d63f049c10f7a5874af9346302db3af128da822339fba103008e18058c5 121712 onionshare_2.6.3-1+deb13u2.debian.tar.xz
 92b80705616150932a5a5a1e8a4fc991358398f55ca86d16935e1d7ef8a27fd6 10832192 onionshare_2.6.3-1+deb13u2.git.tar.xz
 ed642983d113f73ca55aae8f233aa3962cdf382c7681c350699d64171f8a9402 17548 onionshare_2.6.3-1+deb13u2_source.buildinfo
Files:
 f0fa9d51a467d7de6db08cdfbe010a76 3241 net optional onionshare_2.6.3-1+deb13u2.dsc
 a63c0ab206e7b014cf0a6ecfbb94f1a4 121712 net optional onionshare_2.6.3-1+deb13u2.debian.tar.xz
 bcab60499f38ff3a02c62a60a73904ff 10832192 net optional onionshare_2.6.3-1+deb13u2.git.tar.xz
 2c87bf381f402e4903c610aeec450a45 17548 net optional onionshare_2.6.3-1+deb13u2_source.buildinfo
Git-Tag-Info: tag=d34ecd1b56643732ed52dd8d619c8b2ae051af85 fp=39ec11a02016b72926491a06e3adb00850605636
Git-Tag-Tagger: Sandro Knauß <hefee@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmpSfg4ACgkQYG0ITkaD
wHnvqA//eZbBhYPWa0SUnZOLNlqmVConFVawrjM+ORbc5lcLn5wsg66es6yedrh7
3hg5MYymQqll7WJTmKHOx3e3ysXQfIWoT0L0VxP6SC5VF+hFsEze/7BKs8juxI+X
RMlCpbBiRknpy0841FgC0UIpLd8gHcrATk862O8ijDUMkRkQ/jlfaNHH+oVXMWRY
tWrYZpD1Nz5Olgo+Huwusgj5iwUX0drQ5z7jFHHMnF2/MGeuvXhZzHa5zmKrN0Ir
j5iG/AoApkwF6/31u7aYSikcO/oUPwinnMVtrmFD1pVBUYHQXVgbNbfMVnfA40MT
Wn5xXBFMfqFmCDNYr4oJObPUkrSIwuV3Rk86BpRpGaj3XUubsvoMOKHR+Y9GPsvL
gNIP7KnsjyYQIanenhoSk+CecgJrf+gGDx0BF3lFg7ppzkZUqCN3MGjA50Zfbj57
uDb/JYyVPZU5OJCr5KH/0oh+EcUZ7UzC5ezoYBoVvnTmZtytoj/4Mfp1csf2UxQE
pAqGB8dVeL9hmYKGB8zFvkZqL533+1iEihfhcxDL8xLElJTf0zKufeTWqWYpZpOt
KlNY7Lva1qSDex6dXkGTMmTcauPaRPxxvgItBKdpjFAxo9JZRN2geTnUwGTn9Pey
zGW169zN0SrlD4znORCfm6eiVv/VVn2/XVJ3++8b2+e6lJ2kRhs=
=WN5x
-----END PGP SIGNATURE-----

Hi,

Thanks, yes indeed finally. I just have updated the security-tracker
information.

Regards,
Salvatore