Am Sun, Aug 16, 2026 at 02:29:59PM +0200 schrieb Sébastien Helleu:
> On Sun, Aug 16, 2026 at 01:50:42PM +0200, Chris Hofstaedtler wrote:
> > Hi,
> >
> > On Wed, Jul 22, 2026 at 12:18:30PM +0000, [email protected] wrote:
> > > Source: weechat
> > >
> > > weechat 4.9.4 was released a few days ago [1] and claims to fix 2
> > > security vulnerabilites. First vulnerability is likely only exploitable
> > > by a malicious IRC server [2]. The other vulnerability is in the relay
> > > code, and has been assigned GHSA-68ff-gq39-pqjm [3] and the fix is in
> > > [4].
> > >
> > > Please update weechat in debian. Thank you.
> > >
> > > [1] https://weechat.org/news/180/20260719-Version-4.9.4/
> > > [2] https://github.com/weechat/weechat/pull/2340
> > > [3]
> > > https://github.com/weechat/weechat/security/advisories/GHSA-68ff-gq39-pqjm
> > > [4]
> > > https://github.com/weechat/weechat/commit/1a89d796c9cd5d99fcaafd76de55b20540efd4cc
> >
> > Thank you for fixing this in unstable. I'd like to see at least
> > GHSA-68ff-gq39-pqjm be fixed in trixie too, as that is reachable
> > directly and is a trivial authentication bypass. Leading to takeover
> > of weechat sessions.
> >
> > I'm attaching a diff against the version in stable, which I've
> > verified to work.
> >
> > Emmanuel, Security - should this go via trixie-updates instead of
> > security? If so, Emmanuel, can you propose this to trixie-updates?
> >
> > Many thanks,
> > Chris
> >
>
> Hi Chris,
>
> Thank you for the patch.
>
> I fixed many security issues on branch 4.6, specifically for Debian, including
> the one you pointed in relay plugin:
> https://github.com/weechat/weechat/commits/4.6/
>
> But I didn't make any official release as this version is not supported any
> more.
>
> Emmanuel: I would recommend to use this branch with all the fixes and make a
> specific version for Debian, thanks!
Let's also fold this in if we're doing a DSA anyway.
Cheers,
Moritz
