Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] User: [email protected] Usertags: pu
Hi, I'd like to make a stable upload for urwid, fixing CVE-2026-9323. The sec team marked it as no-DSA hence proposing stabe upload. I have manually tested the code and also uploaded to debusine for qa checks. The change is only two line. Dropped the `random` module and added `secrets` and then backported compatible way since upstream patch wont' fix exactly. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable --abhijith
diff -Nru urwid-2.6.16/debian/changelog urwid-2.6.16/debian/changelog --- urwid-2.6.16/debian/changelog 2024-11-18 19:37:18.000000000 +0530 +++ urwid-2.6.16/debian/changelog 2026-09-24 11:48:00.000000000 +0530 @@ -1,3 +1,11 @@ +urwid (2.6.16-1+deb13u1) trixie; urgency=high + + * Non-maintainer upload. + * Fix CVE-2026-9323: Uses cryptographically insecure module Mersenne + Twister PRNG. (Closes: #1147615) + + -- Abhijith PA <[email protected]> Thu, 24 Sep 2026 11:48:00 +0530 + urwid (2.6.16-1) unstable; urgency=medium * Team upload. diff -Nru urwid-2.6.16/debian/patches/CVE-2026-9323 urwid-2.6.16/debian/patches/CVE-2026-9323 --- urwid-2.6.16/debian/patches/CVE-2026-9323 1970-01-01 05:30:00.000000000 +0530 +++ urwid-2.6.16/debian/patches/CVE-2026-9323 2026-09-24 11:48:00.000000000 +0530 @@ -0,0 +1,29 @@ +Description: CVE-2026-9323 + Replace the random module with the cryptographically strong module + called secrets. Following patch generate 18 digit whole number with + secrets. + +Author: Abhijith PA <[email protected]> +Forwarded: not-needed +Last-Update: 2026-09-14 + +--- a/urwid/display/web.py ++++ b/urwid/display/web.py +@@ -28,7 +28,7 @@ import glob + import html + import os + import pathlib +-import random ++import secrets + import selectors + import signal + import socket +@@ -216,7 +216,7 @@ class Screen(BaseScreen): + sys.stdout.write("Status: 503 Sever Busy\r\n\r\n") + sys.exit(0) + +- urwid_id = f"{random.randrange(10 ** 9):09d}{random.randrange(10 ** 9):09d}" # noqa: S311 ++ urwid_id = "".join(secrets.choice("0123456789") for _ in range(18)) + self.pipe_name = os.path.join(_prefs.pipe_dir, f"urwid{urwid_id}") + os.mkfifo(f"{self.pipe_name}.in", 0o600) + signal.signal(signal.SIGTERM, self._cleanup_pipe) diff -Nru urwid-2.6.16/debian/patches/series urwid-2.6.16/debian/patches/series --- urwid-2.6.16/debian/patches/series 2024-11-18 19:36:51.000000000 +0530 +++ urwid-2.6.16/debian/patches/series 2026-09-24 11:48:00.000000000 +0530 @@ -1,2 +1,3 @@ no-sphinx-changelog.diff #version-module.diff +CVE-2026-9323
