Dear Release Team, Salvatore and Python Team, Thank you, Salvatore, for suggesting on 2 November that the other no-dsa CVEs be included in this update. I have prepared and tested that batch. The attached source debdiff against trixie 4.10.1-6 supersedes the one sent on 31 October. The version remains 4.10.1-6+deb13u1; it has not been uploaded.
The candidate now covers: - CVE-2026-106435 / #1150462: BSON C regex bounds (original request); - CVE-2026-96749 / #1148967: BSON C buffer overflow; - CVE-2026-96748 / #1148967: URI hostname parsing; - CVE-2026-96747 / #1148967: KMS endpoint validation; - CVE-2026-88029 / #1147408: GridFS identifier queries. All five fixes are already in unstable. The changes are limited to backported upstream fixes and relevant regressions, with adaptations for 4.10.1. The orig tarball, external dependencies and Uploaders are unchanged. Much of the debdiff consists of upstream test fixtures. The final candidate builds in trixie (812 passed). Separate tests on the built packages report 103 passed / 1 skipped for BSON, URI and KMS, and 160 passed / 9 skipped for GridFS against local MongoDB 8.0.34. The six offline and five GridFS baseline failures pass on the candidate. The attached report includes native C-extension provenance, test limits, the superficial autopkgtest result and the remaining Lintian warning. Could you review the expanded candidate for pre-approval? It remains UNRELEASED; I will finalize the changelog for trixie and the upload qualification after review. I would also appreciate a Python Team reviewer and a sponsor able to upload to stable. As asked in the initial request, would a Salsa MR be helpful for packaging review, and if so, against which repository/branch? Best regards, Federico Molara
pymongo_4.10.1-6_to_4.10.1-6+deb13u1.debdiff
Description: Binary data
pymongo trixie security batch: validation summary, 3 November 2026 Candidate: 4.10.1-6+deb13u1 (UNRELEASED, unsigned, not uploaded) Base: Debian trixie 4.10.1-6 Git branch: work/trixie-security-batch Tested revision: 88c10115688c7f78ec990e980883f0297bd87efb Scope ----- CVE-2026-106435 / #1150462: bounded C BSON regex scans. CVE-2026-96749 / #1148967: signed integer overflow in the C BSON buffer. CVE-2026-96748 / #1148967: percent-encoded URI hostname parsing. CVE-2026-96747 / #1148967: reject Unix-socket KMS endpoints, sync/async. CVE-2026-88029 / #1147408: exact-match GridFS identifier queries, including sync/async delete, rename, open/read, abort and metadata paths. Upstream fix commits, in that order: bb8d4e195275e75bd94ebeffb53cc747d357fcf4 6ab44be0e97c9d1d5a23725c4978fb25f3249485 1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a 44119d0f9dfa0224d84b03be702a6d9a5ef1dea7 fa676586ba4b399168a4d1d41c30dc2166cc44fd The BSON allocation regression includes its upstream resource guard (98f444b3984552fbfe523c6d0187a33dc0ca7930). The old URI parser and GridFS layout were adapted without importing newer driver architecture. The GridFS test runner includes only the upstream NoFile client-error classification (8675a163df130007909ea36ad3828b645bb292c1). The orig tarball, external dependencies and historical Uploaders are unchanged. One quilt patch per CVE; no unrelated fixes or feature updates. Environment and package provenance ---------------------------------- Temporary trixie amd64 schroot overlays; Python 3.13.5. Server tests: standalone MongoDB 8.0.34 at 127.0.0.1:27017. Baseline and candidate regression runs load the respective extracted .deb packages. bson.has_c() and pymongo.has_c() are true; native module paths and SHA256 hashes are checked against the extracted packages. The same test files are used for baseline and candidate comparisons. Final results ------------- sbuild amd64 + arch-all: PASS, exit 0. 812 passed, 3711 skipped, 790 deselected, 2 warnings. Build tests use an unused local port; server tests are separate below. BSON/URI/KMS regressions on built packages: Baseline: 96 passed, 6 failed, 1 skipped, 1 deselected (expected exit 1). Candidate: 103 passed, 0 failed, 1 skipped (exit 0). All six baseline failures pass on the candidate. The upstream multi-GiB encoding regression also passes on the candidate's C extension; it is deliberately not run against the known-vulnerable baseline binary. The sole skip is a pre-existing CPython issue25222 test. GridFS regressions on built packages with the local server: Baseline: 155 passed, 5 failed, 9 skipped, 22 warnings (expected exit 1). Candidate: 160 passed, 0 failed, 9 skipped, 22 warnings (exit 0). All eight added CVE cases pass: six unified query cases plus abort regressions for both sync and async APIs. All five baseline failures pass on the candidate; there are no setup errors or new exclusions. Skips: six replica-set/secondary cases, one unavailable failpoint, one existing PYTHON-4598 skip, one sync-only zip test in the async suite. Warnings are existing GridFS deprecations; the old async test framework also emits a client-close ResourceWarning after the suite on both runs. Declared autopkgtest: autodep8-python3 PASS (superficial), exit 8. This is an import smoke test, not the CVE regression suite. Lintian 2.122.0, source DSC and all eight .deb files: exit 0, no errors. Warning: no-nmu-in-changelog. The historical trixie Uploaders were retained; the upload qualification will be finalized with the reviewer/uploader. Eight binary packages: external dependencies unchanged after normalization of internal package-version references. Host and all three persistent chroot dpkg/status hashes unchanged; temporary sessions closed. Test adaptation and limits -------------------------- The first GridFS candidate run had one test-runner failure: the driver correctly raised NoFile but the old unified runner did not classify it as a client error. Only the two upstream helper lines were added, with no runtime change or weakened fixture. Source and .deb files were rebuilt, and all results above refer to that final revision. Earlier logs are kept. KMS callback regressions use the upstream .sock endpoint and mocked I/O; credential-dependent encryption integration tests were not exercised. No full TLS/KMS/replica-set matrix or modern async GridFS spec runner. No pen-tests, fuzzing or additional memory diagnostics were performed.
