This fixes a path traversal security vulnerability (CVE-2026-79655) which
was marked as <no-dsa>.
If not fixed, then users using sos clean on untrusted archives could suffer
an arbitrary file overwrite/path traversal attack.
Bug #1145981 and the CVE ID CVE-2026-79655
This is low risk, as the patches are direct backports of the upstream fix,
isolated strictly to the tar extraction verification logic inside the clean
component
Debdiff below
[ Reason ]
sos has a CVE, CVE-2026-79655, which is a low risk for trixie, and has
been uploaded to sid, forky, and trixie-backports
[ Impact ]
The users using sos clean on untrusted archives could suffer an
arbitrary file overwrite/path traversal attack.
[ Tests ]
Ran the reproducer as defined in the upstream bug [1], shown below.
The package was built on salsa, and installed on a trixie development
machine.
root@trixie-dev:~# python3 ./reproducer.py
[cleaner] skipping tar member 'sosreport-test/var/log/escape':
'sosreport-test/var/log/escape' is a link to an absolute path
OK: file did not escape the extraction directory
[ Risks ]
sos may not collect the corresponding files for evaluation overall
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Update the included patches that solve the CVE, we had to bring in 1
extra patch as a dependancy, and added extra line for an import of the
module for unit tests
In unstable this was handled by building with the new sos package,
with the relevant patches back-ported from upstream.
Created an MR on salsa [2], that shows the diff, and would constitute
my debdiff for the update
[1] https://github.com/sosreport/sos/issues/4460#issuecomment-6042532211
[2] https://salsa.debian.org/python-team/packages/sosreport/-/merge_requests/35
---
Arif Ali
IRC: arif-ali
Matrix: @arif-ali:ubuntu.com