Bug#1142123: bookworm-pu: package modsecurity/3.0.9-1+deb12u3

Hi Alberto,

On Wed, Jul 15, 2026 at 05:25:55PM +0200, Alberto Gonzalez Iniesta wrote:
> Package: release.debian.org
> Severity: normal
> Tags: security
> X-Debbugs-Cc: [email protected], [email protected], Debian Security Team <[email protected]>
> Control: affects -1 + src:modsecurity
> User: [email protected]
> Usertags: pu
> 
> [ Reason ]
> Fixes for CVE-2026-52747 and CVE-2026-52761
> 
> [ Impact ]
> Security rules bypass.
> 
> [ Tests ]
> Fixed and tested by upstream.
> 
> [ Risks ]
> Low risk, simple patch.
> 
> [ Checklist ]
>   [x] *all* changes are documented in the d/changelog
>   [x] I reviewed all changes and I approve them
>   [x] attach debdiff against the package in (old)stable
>   [x] the issue is verified as fixed in unstable
> 
> [ Changes ]
> Preserve line breaks from non-file form-field values.
> Fix returned length of "unicode" variable.

> diff -Nru modsecurity-3.0.9/debian/changelog modsecurity-3.0.9/debian/changelog
> --- modsecurity-3.0.9/debian/changelog	2026-04-30 17:13:44.000000000 +0200
> +++ modsecurity-3.0.9/debian/changelog	2026-06-30 19:11:37.000000000 +0200
> @@ -1,3 +1,14 @@
> +modsecurity (3.0.9-1+deb12u3) bookworm; urgency=medium
> +
> +  [ Alberto Gonzalez Iniesta ]
> +  * Restore d/changelog entry for deb12u1
> +  * Fix CVE number
> +
> +  [ Ervin Hegedus ]
> +  * Add fixes for CVE-2026-52747 and CVE-2026-52761
> +
> + -- Ervin Hegedüs <[email protected]>  Tue, 30 Jun 2026 19:11:37 +0200

As this proposed update targets 'bookworm'. Debian bookworm is now
handed over to the LTS team, so no point releases are happening
anymore, but updates are released via DLA's. I'm cc'ing the LTS list.

Regards,
Salvatore