Bug#1141973: trixie-pu: package bettercap/2.33.0-1+deb13u1

Francisco Vilmar Cardoso Ruviaro <[email protected]> Mon, 13 Jul 2026 03:25:07 +0000
Newsgroups	gmane.linux.debian.devel.release
Message-ID	<94e93c82-44bd-472b-882c-63fdbeb09009__40632.0059018739$1783913249$gmane$org@debian.org>
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu

Dear Release Team,

I would like to update the bettercap on the trixie to prevent remote DoS via
crafted client handshake on mysql.server module, because during a review of
the Debian Security Tracker, I found CVE-2026-8276.

There is no DSA assigned to the bug and it was marked "no-dsa" and so I'm doing
a normal upload.

"mysql.server crashes entire process on crafted client handshake (remote DoS)",
as reported in: https://github.com/bettercap/bettercap/issues/1265

This vulnerability has been assigned the CVE id CVE-2026-8276.

Upstream fixed the bug at:
https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8276
[1] https://security-tracker.debian.org/tracker/CVE-2026-8276
[2] https://bugs.debian.org/1136448

Regards,
Francisco

diff -Nru bettercap-2.33.0/debian/changelog bettercap-2.33.0/debian/changelog
--- bettercap-2.33.0/debian/changelog	2024-08-18 20:54:15.000000000 +0000
+++ bettercap-2.33.0/debian/changelog	2026-07-13 02:41:40.000000000 +0000
@@ -1,3 +1,10 @@
+bettercap (2.33.0-1+deb13u1) trixie; urgency=medium
+
+  * Add debian/patches/CVE-2026-8276.patch.
+    (Closes: #1136448, CVE-2026-8276)
+
+ -- Francisco Vilmar Cardoso Ruviaro <[email protected]>  Mon, 13 Jul 2026 02:41:40 +0000
+
 bettercap (2.33.0-1) unstable; urgency=medium
 
   * New upstream version 2.33.0.
diff -Nru bettercap-2.33.0/debian/patches/CVE-2026-8276.patch bettercap-2.33.0/debian/patches/CVE-2026-8276.patch
--- bettercap-2.33.0/debian/patches/CVE-2026-8276.patch	1970-01-01 00:00:00.000000000 +0000
+++ bettercap-2.33.0/debian/patches/CVE-2026-8276.patch	2026-07-13 02:34:14.000000000 +0000
@@ -0,0 +1,34 @@
+Description: Fix mysql.server panic on crafted client handshake (remote DoS).
+Author: Simone Margaritelli <[email protected]>
+Origin: upstream, https://github.com/bettercap/bettercap/commit/0eaa375c5e5446bfba94a290eff92967a5deac9e.patch
+Bug: https://github.com/bettercap/bettercap/issues/1265
+Bug-Debian: https://bugs.debian.org/1136448
+Forwarded: not-needed
+Reviewed-By: Francisco Vilmar Cardoso Ruviaro <[email protected]>
+Last-Update: 2026-07-10
+
+--- a/modules/mysql_server/mysql_server.go
++++ b/modules/mysql_server/mysql_server.go
+@@ -121,15 +121,20 @@ func (mod *MySQLServer) Start() error {
+ 				if _, err := conn.Write(packets.MySQLGreeting); err != nil {
+ 					mod.Warning("error while writing server greeting: %s", err)
+ 					continue
+-				} else if _, err = reader.Read(readBuffer); err != nil {
++				} else if read, err = reader.Read(readBuffer); err != nil {
+ 					mod.Warning("error while reading client message: %s", err)
+ 					continue
+ 				}
+ 
++				if read < 37 {
++					mod.Warning("client handshake too short (%d bytes)", read)
++					continue
++				}
++
+ 				// parse client capabilities and validate connection
+ 				// TODO: parse mysql connections properly and
+ 				//       display additional connection attributes
+-				capabilities := fmt.Sprintf("%08b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
++				capabilities := fmt.Sprintf("%016b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
+ 				loadData := string(capabilities[8])
+ 				username := string(bytes.Split(readBuffer[36:], []byte{0})[0])
+ 
diff -Nru bettercap-2.33.0/debian/patches/series bettercap-2.33.0/debian/patches/series
--- bettercap-2.33.0/debian/patches/series	2024-08-18 17:41:44.000000000 +0000
+++ bettercap-2.33.0/debian/patches/series	2026-07-13 02:34:56.000000000 +0000
@@ -1,3 +1,4 @@
 adapt-service-file.patch
 disable-install-update-bettercap.patch
 disable-install-update-caplets.patch
+CVE-2026-8276.patch

Regards,
-- 
Francisco Vilmar Cardoso Ruviaro <[email protected]>
4096R: 1B8C F656 EF3B 8447 2F48 F0E7 82FB F706 0B2F 7D00
OpenPGP_signature.asc (application/pgp-signature, 840 B)