-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Mar 2026 16:52:10 +0200 Source: inetutils Binary: inetutils-ftp inetutils-ftp-dbgsym inetutils-ftpd inetutils-ftpd-dbgsym inetutils-inetd inetutils-inetd-dbgsym inetutils-ping inetutils-ping-dbgsym inetutils-syslogd inetutils-syslogd-dbgsym inetutils-talk inetutils-talk-dbgsym inetutils-talkd inetutils-talkd-dbgsym inetutils-telnet inetutils-telnet-dbgsym inetutils-telnetd inetutils-telnetd-dbgsym inetutils-tools inetutils-tools-dbgsym inetutils-traceroute inetutils-traceroute-dbgsym Architecture: armhf Version: 2:2.4-2+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: arm Build Daemon (arm-ubc-05) Changed-By: Guillem Jover Description: inetutils-ftp - File Transfer Protocol client inetutils-ftpd - File Transfer Protocol server inetutils-inetd - internet super server inetutils-ping - ICMP echo tool inetutils-syslogd - system logging daemon inetutils-talk - talk to another user inetutils-talkd - remote user communication server inetutils-telnet - telnet client inetutils-telnetd - telnet server inetutils-tools - base networking utilities (experimental package) inetutils-traceroute - trace the IPv4 route to another host Closes: 1130741 1130742 Changes: inetutils (2:2.4-2+deb12u3) bookworm-security; urgency=high . * Add patch from upstream: - Prevent privilege escalation via telnetd abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. Reported by Ron Ben Yizhak . Fixes CVE-2026-28372. - Ignore all environment options from clients unless the variable was listed in the new --accept-env telnetd option. This mitigates privilege escalation using environment variables. This is the complete fix for CVE-2026-24061, with its own CVE pending. - Fix stack buffer overflow processing SLC suboption triplets. Reported by Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel at DREAM Security Research Team. Fixes CVE-2026-32746. (Closes: #1130742) * Add the hashcode-string1 module from forky/sid gnulib adapted to bookworm required by the --accept-env patch, and the gl_hash_set, gl_set, gl_xset and gl_anyhash bookworm gnulib modules required by hashcode-string1. Inject new gnulib modules in lib/Makefile.am. * Adapt netkit-telnet patch to not leak unexported environment variables to telnetd. Reported by Justin Swartz . Fixes CVE-2026-32772. (Closes: #1130741) * Prevent user local privilege escalation using --debug, which was susceptible to symlink attacks, or leaking on-wire credentials to a user that had pre-created the file and kept it open. Fix by switching from /tmp/telnet.debug to /run/telnet/debug., and making the setup error checks fatal. Partially reported by Justin Swartz . * Update local telnetd man page to match new --debug behavior. Checksums-Sha1: de09442a62c07d876eb3cc26491a9b824947afdf 153800 inetutils-ftp-dbgsym_2.4-2+deb12u3_armhf.deb 020750122163bcae36f3711b14e0680346045c75 100748 inetutils-ftp_2.4-2+deb12u3_armhf.deb 88b4fbe21d30498b238895d5be1e4e53c858f372 184636 inetutils-ftpd-dbgsym_2.4-2+deb12u3_armhf.deb 3204570b72ad5cb2fdda94f57aca45609e7978af 100560 inetutils-ftpd_2.4-2+deb12u3_armhf.deb 252b9ecd224851b9632fcc0c2978b55e17c42e44 103228 inetutils-inetd-dbgsym_2.4-2+deb12u3_armhf.deb 3231c742826c91b5867f68da602d293f5aaf43e4 76324 inetutils-inetd_2.4-2+deb12u3_armhf.deb bcee3c5ffdf8bd74a64feb96922d4cdc51b2e408 180512 inetutils-ping-dbgsym_2.4-2+deb12u3_armhf.deb 41d0827f8b3b466d55f23158e511ac9eba1bb0e6 81036 inetutils-ping_2.4-2+deb12u3_armhf.deb 232bcafbe4596372768f1bdcb7c5d8856e13524d 109188 inetutils-syslogd-dbgsym_2.4-2+deb12u3_armhf.deb d3d64d10d73dcd10de63ba7014fad12b7e1502d1 79152 inetutils-syslogd_2.4-2+deb12u3_armhf.deb c843ec76b11db68194e4912bdb4ac43f31be09e6 84672 inetutils-talk-dbgsym_2.4-2+deb12u3_armhf.deb 772a7da932e70985297048e702209c05888504af 65832 inetutils-talk_2.4-2+deb12u3_armhf.deb 9f4fe4b4f310f149684a791adf4091e1b569be50 99356 inetutils-talkd-dbgsym_2.4-2+deb12u3_armhf.deb b6261b2d3b1165286645296fe61d21bd6e1c367a 67488 inetutils-talkd_2.4-2+deb12u3_armhf.deb 306f7ef5e29fa150d7383bb7fa4750979110a8f9 203348 inetutils-telnet-dbgsym_2.4-2+deb12u3_armhf.deb 0e9fbb161866cbae111deaf5a7688dafdf36df70 110192 inetutils-telnet_2.4-2+deb12u3_armhf.deb eb45afb38ae2c0607facc8cadb539449dfac0af9 179812 inetutils-telnetd-dbgsym_2.4-2+deb12u3_armhf.deb 719c64dfb1f4214e571d33f4f61297aa20ef644a 96848 inetutils-telnetd_2.4-2+deb12u3_armhf.deb 3aeadab4be51fb0a6bd7add3a831c31ad46ae32d 319592 inetutils-tools-dbgsym_2.4-2+deb12u3_armhf.deb d5b438c522940de3e8cbb76702eb10fc5aae92a8 89944 inetutils-tools_2.4-2+deb12u3_armhf.deb 9008a826032981597cfdf1b4c647a0d2dee163cb 84640 inetutils-traceroute-dbgsym_2.4-2+deb12u3_armhf.deb 82e519364477459050e255d042f97e7d01a6192e 64176 inetutils-traceroute_2.4-2+deb12u3_armhf.deb 1ca6aa5744dcdbd87754ac885db6a23ff54aac89 12993 inetutils_2.4-2+deb12u3_armhf-buildd.buildinfo Checksums-Sha256: bc407accd568a8cae253442c0878c9c958161c3f61574ef1ad1c8b75933979d7 153800 inetutils-ftp-dbgsym_2.4-2+deb12u3_armhf.deb 1f505ec857ede3883cd4d7f59d99e72a3795a2a51094349283b5afd739eaeffd 100748 inetutils-ftp_2.4-2+deb12u3_armhf.deb fe13addd2e899dddf68db0ee27384fd5a4ee4b8a17e06eff6abefa9b0e9aa8cc 184636 inetutils-ftpd-dbgsym_2.4-2+deb12u3_armhf.deb 609e1e79ffdf7441f8eb4e5410311a591c81cc3678d9c5e6ac79b522a199249a 100560 inetutils-ftpd_2.4-2+deb12u3_armhf.deb c44878c37596e91cd1ddb863b493646a658414a0a2131c5592a827142593758b 103228 inetutils-inetd-dbgsym_2.4-2+deb12u3_armhf.deb d98a0683dedbf84231b475c5e676999cd9820ead46af0ab0cf417c73a5a1892f 76324 inetutils-inetd_2.4-2+deb12u3_armhf.deb 9e8094815556ffc5ccdab1bd4919a81e94516a44f1024cff2a1d6b63fc18f2c4 180512 inetutils-ping-dbgsym_2.4-2+deb12u3_armhf.deb 9c09d55cbbcf9b59dd66b78a8fc716e7e1a29ae25008adf0a0641d46b18ffc3b 81036 inetutils-ping_2.4-2+deb12u3_armhf.deb e3e579f487c6ba05ec5767dfd836dc2c18266dee5c6fb13f839d95b5708f04f0 109188 inetutils-syslogd-dbgsym_2.4-2+deb12u3_armhf.deb b2202b6bef3c1e3f668b1de0e23c7de527c5687dd475c26e86e9730b1d2994df 79152 inetutils-syslogd_2.4-2+deb12u3_armhf.deb 86fab182891ee0870a5e001e01827086fa1ec836f4bccd60d3d1c783f6c38778 84672 inetutils-talk-dbgsym_2.4-2+deb12u3_armhf.deb 8f6582d322a696333a84103ed5b623ee18b228266dd3b756ea73456574bfce4c 65832 inetutils-talk_2.4-2+deb12u3_armhf.deb 01304ffb25a777a927cf763fd1384dcc3b381947c634bce634b1174ddfcd83d1 99356 inetutils-talkd-dbgsym_2.4-2+deb12u3_armhf.deb 78c516aaa41a5a674ced03879dee5ce5bcdbc6727671b30dd1435583ba0ef895 67488 inetutils-talkd_2.4-2+deb12u3_armhf.deb 7edf471ca8aecec5c26822fff4431f5ded8d600d09dc5e8e26c5402b42244597 203348 inetutils-telnet-dbgsym_2.4-2+deb12u3_armhf.deb 8bd84775f5f4f7ef52d37095e491b9a782fc7c583b66149f4fddd8d87c14bd25 110192 inetutils-telnet_2.4-2+deb12u3_armhf.deb 976f5881efbbed4217b5d4388471e2e8b50ba5983b51bfbc90d0e9dfac31eb13 179812 inetutils-telnetd-dbgsym_2.4-2+deb12u3_armhf.deb d9bd6c5dc1a719dec3a97d47b385c6bbad56bb88ce0b595517a559f33faee0c4 96848 inetutils-telnetd_2.4-2+deb12u3_armhf.deb 62b947518c5be62f26e9c79fb7b3b2d0610fca0f46e568918e8f6596ae065d67 319592 inetutils-tools-dbgsym_2.4-2+deb12u3_armhf.deb a36dac3a941d684640801b1df67bcfc7cb3992826266bebfbae40b9eb69145c0 89944 inetutils-tools_2.4-2+deb12u3_armhf.deb 861b512157fe7b11a27ae9a68712de222b62a858d885f6d9feaaa945f760b5f5 84640 inetutils-traceroute-dbgsym_2.4-2+deb12u3_armhf.deb 3c0c5ada07ef96433324dc1beff0b9703aa2d6bd9f39e1096a2300e3690058fd 64176 inetutils-traceroute_2.4-2+deb12u3_armhf.deb e42a9f855a981b1013133bd36528601af2d51f13dff386b222d0fb7a34a03529 12993 inetutils_2.4-2+deb12u3_armhf-buildd.buildinfo Files: f0aef9e3722bb283e9036c5d8d92f2b1 153800 debug optional inetutils-ftp-dbgsym_2.4-2+deb12u3_armhf.deb 299a33631d336fbd56ad31e1a7efc7b7 100748 net optional inetutils-ftp_2.4-2+deb12u3_armhf.deb fda011aa45a1070c95fca73018756890 184636 debug optional inetutils-ftpd-dbgsym_2.4-2+deb12u3_armhf.deb 0ae994a14776663cac6108d3931007ea 100560 net optional inetutils-ftpd_2.4-2+deb12u3_armhf.deb 513c871b84908dba0bf0ed0a1dd056fc 103228 debug optional inetutils-inetd-dbgsym_2.4-2+deb12u3_armhf.deb 2cc5c5adc56ad8fee23ecfa6d5df5eef 76324 net optional inetutils-inetd_2.4-2+deb12u3_armhf.deb 71a71b9ea7b7dfebbe6e96b692848c3f 180512 debug optional inetutils-ping-dbgsym_2.4-2+deb12u3_armhf.deb 313d49b20c9ee7c59034080e9d8b6033 81036 net optional inetutils-ping_2.4-2+deb12u3_armhf.deb 0835b31d6354619bc785537469fd9696 109188 debug optional inetutils-syslogd-dbgsym_2.4-2+deb12u3_armhf.deb 74bba5cc22c2563027e54d6a220ebb95 79152 net optional inetutils-syslogd_2.4-2+deb12u3_armhf.deb 5936f052aa19ecd51197621c1e03d52d 84672 debug optional inetutils-talk-dbgsym_2.4-2+deb12u3_armhf.deb 035766100c4a0cea85b818ba710e8144 65832 net optional inetutils-talk_2.4-2+deb12u3_armhf.deb 7763d8d9ac5a209ac2cc7336c3372278 99356 debug optional inetutils-talkd-dbgsym_2.4-2+deb12u3_armhf.deb d43032f53f332fb2bd9e5bd88fc16e43 67488 net optional inetutils-talkd_2.4-2+deb12u3_armhf.deb 4ab0cc624adc77fb942661d0324081b2 203348 debug optional inetutils-telnet-dbgsym_2.4-2+deb12u3_armhf.deb e800eeeb231e398b71f50ac072548c4d 110192 net standard inetutils-telnet_2.4-2+deb12u3_armhf.deb cc6b07388addace0a0a392242e659e7f 179812 debug optional inetutils-telnetd-dbgsym_2.4-2+deb12u3_armhf.deb 5d34827a7e38b4f184a4836591b425c5 96848 net optional inetutils-telnetd_2.4-2+deb12u3_armhf.deb 9b3d7d6842e050b53ad1c3961913ef43 319592 debug optional inetutils-tools-dbgsym_2.4-2+deb12u3_armhf.deb 0630fdcd746a85f26115c653a136cced 89944 net optional inetutils-tools_2.4-2+deb12u3_armhf.deb 65a9f85134fe094b8b871157e2d8a1f8 84640 debug optional inetutils-traceroute-dbgsym_2.4-2+deb12u3_armhf.deb f864df2293fa7b05c6d7fa021010df5a 64176 net optional inetutils-traceroute_2.4-2+deb12u3_armhf.deb 03dac478e65f9152ea36cf40164b580b 12993 net optional inetutils_2.4-2+deb12u3_armhf-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEiIG3Q3DxwDgRKKeyLRECdjCZQkcFAmnL28EACgkQLRECdjCZ Qkcl/Q//aCnapbMMQ3sOkfNkAob+tdOghzz7ml5AJMAmYgaGL0ZHKbQPFI/sgc1X /OKWvQG5jaSKvqeUSgSEqAWM9y5kCjcbVPs8px/8ax52KRIHpppPnhGv3h9ZM1eJ kYuJiOeqMd1y5ucS5KGi5yfrVzXZntDPamK1xSZW91tFbTJXtgaaMqBrUlPsW10Z d3cd/oxBegR/FY4XSHSjdBjp5kHcDYsMzqZ6kZ28xh+dJUcxxvw5okX8d1RcQvQ7 mXEoUxTf7l3g4DrjZ3ELAzACgZGryJPuEyXHiFhbrjeVkHJA+TzOYaC85EvsPMYv k0S2oikW3sOB6XDvRtDVMJrAuDkudSKXyCCSdUGDCqI2TXfXVslvAS5jUXhi3TnN SptZJSASRY5AbKJr7TgErIuO1lZZwhQv+mhfhYN5dzb28BHiJYYc5FC9Bf4Esm5U JhYIs4tGayJe0hs6pK2F/BFVW0pxvcSbZeeZO/njDTkXkQphMyMKyPxGdZLkZo4h ANMjYHdNPEdX3jc03eWtrHc4+flmBy7ws0eLeE1DFYcatNkOGnM4O9jysEUnsJWy INVyzKBJP8UG7O9do8OHFXuAmgVFVGIoDAE3zomvm+jn3rGWq87C/pk5OF7NmWAu IrGWTa8WSyhuZqu5+u50pEFdf1d/Ya9WYWLqkplTIUuotDEVzlM= =+5J1 -----END PGP SIGNATURE-----