Re: On bumping/fixing biber 2.22 in debian

Hello,

my plan was to migrate the biber repo to salsa for the new release, which does not work for any reason (the import). I did not test further b/c I'm on the road and packaging is not fun on a smartphone.
Are you the maintainer of biber in Ubuntu? Can you release the fix as new Ubuntu revision? Maybe I can create a new Debian revision if you provide the patch...

Hilmar

18.08.2026 10:30:40 Pavel Sanda <[email protected]>:

> Hi Hilmar,
> 
> do you think it would be possible to bump biber to 2.22 before
> ubuntu imports freezes for the next release (2026-08-20)?
> 
> I would like to get the injection fix in before the window closes.
> The vulnerability is briefly documented at
> https://www.openwall.com/lists/oss-security/2026/08/17/1
> 
> I checked that bcf/bbl version remained same since 2.20
> so no problem should appear for the bump.
> 
> Apart from that I had lower priority question whether you think
> backporting fixes back to trixie or offering backport is viable
> option for trixie.
> 
> Even lower-prio issue is that from LyX POV current debian ships
> vulnerable xindy. It's caused by debian's own patchset and this won't
> be fixed by later TL updates. I can write details later in case
> you have time to deal with it. I think current security team
> is totally overwhelm by large scale issues, so it is leftover
> for normal maintainers...
> 
> Thanks,
> Pavel