Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:binwalk User: [email protected] Usertags: pu
Dear Release Managers, I would like to close this bug regarding trixie through p-u: https://bugs.debian.org/1136010 [ Reason ] This fixes CVE-2026-7179 for trixie. [ Impact ] A path traversal vulnerability exists in binwalk up to 2.4.3 which can be escalated to remote code execution. The attack can only be performed from a local environment. In Debian we are currently stuck to upstream version 2.4.3 for upstream switched from Python to Rust with version 3.x.x requiring whole new packaging at Debian's end. [ Tests ] I tested the code from the patch manually in a python console to verify it does what it is supposed to. I ran the autopkgtests locally with success. [ Risks ] I consider the risks nil as the patch is the same applied in unstable, plus unstable and stable base on the same upstream version. [ Checklist ] [*] *all* changes are documented in the d/changelog [*] I reviewed all changes and I approve them [*] attach debdiff against the package in (old)stable [*] the issue is verified as fixed in unstable -- GPG Fingerprint 3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585
diff -Nru binwalk-2.4.3+dfsg1/debian/changelog binwalk-2.4.3+dfsg1/debian/changelog --- binwalk-2.4.3+dfsg1/debian/changelog 2025-03-14 21:25:15.000000000 +0100 +++ binwalk-2.4.3+dfsg1/debian/changelog 2026-08-26 19:06:33.000000000 +0200 @@ -1,3 +1,11 @@ +binwalk (2.4.3+dfsg1-2+deb13u1) trixie; urgency=medium + + * Team upload. + * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179; + thanks to Fukui Daichi for providing the patch (Closes: #1136010). + + -- Sven Geuer <[email protected]> Wed, 26 Aug 2026 19:06:33 +0200 + binwalk (2.4.3+dfsg1-2) unstable; urgency=medium * Team upload. diff -Nru binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch --- binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch 1970-01-01 01:00:00.000000000 +0100 +++ binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch 2026-08-26 19:06:33.000000000 +0200 @@ -0,0 +1,57 @@ +Description: Prevent path traversal in WinCE extraction plugin + The WinCE extraction plugin trusted filenames supplied by the input + image and used them directly to construct output paths. A crafted + WinCE image could therefore cause files to be written outside the + extraction directory. + . + Resolve the extraction paths and ensure they remain below the + extraction directory before writing files. + . + CVE-2026-7179 +Bug-Debian: https://bugs.debian.org/1136010 +Forwarded: not-needed +Author: Fukui Daichi <[email protected]> +Reviewed-by: Sven Geuer <[email protected]> +Last-Update: 2026-08-26 +--- a/src/binwalk/plugins/winceextract.py ++++ b/src/binwalk/plugins/winceextract.py +@@ -1,4 +1,5 @@ + import binwalk.core.plugin ++from binwalk.core.common import warning + import re + import os + +@@ -41,6 +42,16 @@ + if match is not None: + self.image_start = result.offset + ++ def _safe_output_path(self, indir, filename): ++ indir = os.path.realpath(indir) ++ output_path = os.path.realpath(os.path.join(indir, filename)) ++ ++ if os.path.commonpath([indir, output_path]) != indir: ++ warning("Path traversal blocked: %s" % filename) ++ return None ++ ++ return output_path ++ + def extractor(self, fname): + """ + Called when a file matches the extraction criteria set by the init method. +@@ -58,8 +69,14 @@ + with open(infile, 'r+b') as f: + with WinCEExtractor(f, 0) as extractor: + for module in extractor.modules: +- with open(os.path.join(indir, module.file_name), 'w+b') as module_file: ++ output_path = self._safe_output_path(indir, module.file_name) ++ if output_path is None: ++ continue ++ with open(output_path, 'w+b') as module_file: + module.write_to(module_file) + for file_e in extractor.files: +- with open(os.path.join(indir, file_e.file_name), 'w+b') as file_file: ++ output_path = self._safe_output_path(indir, file_e.file_name) ++ if output_path is None: ++ continue ++ with open(output_path, 'w+b') as file_file: + file_e.write_to(file_file) diff -Nru binwalk-2.4.3+dfsg1/debian/patches/series binwalk-2.4.3+dfsg1/debian/patches/series --- binwalk-2.4.3+dfsg1/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ binwalk-2.4.3+dfsg1/debian/patches/series 2026-08-26 19:06:33.000000000 +0200 @@ -0,0 +1 @@ +prevent-path-traversal-in-wince.patch
signature.asc
Description: This is a digitally signed message part
