#1153221 zoneminder: removal of dependency on libdata-entropy-perl

Package:
src:zoneminder
Source:
src:zoneminder
Submitter:
Étienne Mollier
Date:
2026-11-06 17:15:02 UTC
Severity:
normal
Tags:
#1153221#5
Date:
2026-11-06 11:14:33 UTC
From:
To:
Source: zoneminder
Version: 1.36.37+dfsg1-1.1
Severity: important
Tags: upstream patch

Dear Maintainer,

In the light of #1143264 about CVE-2026-18536 affecting
libdata-entropy-perl, I ponder on the option suggested by
Salvatore of removing the package from the archive for the
upcoming forky.  When looking up the usage of Data::Entropy in
ZoneMinder, I noted the module is still imported in zoneminder's
zmupdate.pl in Debian sid, but that does not look to be the case
anymore for the upcoming releases upstream[1].

[1]: https://github.com/ZoneMinder/zoneminder/commit/ad3d5ec54da7dfb8641d42581507c9cdde567ddf

When applying the patch or upgrading to the newer ZoneMinder
release, please don't forget removal of the dependency on
libdata-entropy-perl from d/control.  :)

In hope this helps,