Arnaud Rebillout

Linux/FOSS software engineer Debian Developer

Powered by Pelican • Source at GitLab
© 2015-2025 Arnaud Rebillout

Debian Long Term Support

My activity as part of the Debian LTS team, on behalf of Freexian.

Debian LTS exists thanks to the generous donations of its sponsors. If your company relies on it, please consider funding the project. Thanks.

2026, October

xorg-server

Debian ELTS: Uploaded 2:1.20.4-1+deb10u19 in buster and 2:1.19.2-1+deb9u24 in stretch, issued ELA-1866-1, fixing:

openssl

Debian LTS: Uploaded 3.0.22-1~deb12u2 in bookworm, issued DLA-4859-1, fixing:

perl

Debian LTS: Uploaded 5.36.0-7+deb12u4 in bookworm, issued DLA-4821-1.

Debian ELTS: Uploaded 5.32.1-4+deb11u6 in bullseye, 5.28.1-6+deb10u4 in buster and 5.24.1-3+deb9u10 in stretch, issued ELA-1856-1.

The above uploads fix the following CVEs:

libio-compress-perl

Debian LTS: Uploaded 2.204-1+deb12u1 in bookworm, issued DLA-4812-1.

Debian ELTS: Uploaded 2.101-1+deb11u1 in bullseye, issued ELA-1858-1.

The above uploads fix the following CVEs:

libmodule-cpants-analyse-perl

Debian LTS: Uploaded 1.01-1+deb12u1 in bookworm, issued DLA-4821-2.

Debian ELTS: Uploaded 1.01-1+deb11u1 in bullseye, 0.99-1+deb10u1 in buster and 0.96-1+deb9u1 in stretch, issued ELA-1856-2.

This is a regression update to fix the test suite, broken by the security fix for CVE-2026-42496 (symlink escape in Archive::Tar) in perl.

libcpan-reporter-smoker-perl

Debian ELTS: Uploaded 0.29-1+deb11u1 in bullseye, issued ELA-1859-1.

This is a regression update to fix the build and the test suite, broken by a perl upload some time ago. The regression was fixed for buster and stretch, but bullseye was left out, and the build failure was caught during QA for the perl upload mentioned above.

Misc / Debusine

Investigate false positive in regression tracking (rev-deps autopkgtests), turns out the reference tests pick the package from the base suite, rather than the -security suite. Filed a bug to track this issue: https://salsa.debian.org/freexian-team/debusine.debian.net/support/-/work_items/24

Investigate some autopkgtests that didn't run autodep8 tests, turns out it was caused by new workers where autodep8 wasn't installed. Quickly fixed by the Debusine admin team.

Misc / Packages

Check a flaky test for glib2.0, seems like it's an easy fix, filed https://salsa.debian.org/gnome-team/glib/-/merge_requests/74 to clarify.

2026, September

openssl

Debian LTS: Uploaded 3.0.22-1~deb12u1 in bookworm, issued DLA-4795-1, fixing:

During testing of this new version, a regression was identified in the nodejs test suite, caused by a change in OpenSSL behavior (more specifically https://github.com/openssl/openssl/pull/32427/). This was fixed in nodejs by https://github.com/nodejs/node/commit/28b571c38af5, so I backported this patch for bookworm as well.

perl

Debian LTS (bookworm): Work in progress to fix numerous CVEs, I'm now waiting for the (extensive) QA to finish before I can upload to bookworm, probably by end of week, or next week at the latest.

Some CVEs also affect libio-compress-perl, also waiting to clear the QA before it can be uploaded.

2026, August

ca-certificates

Debian LTS: Reviewed and tested the updates for bookworm and buster (with Bastien Roucaries).

Debian ELTS: Uploaded 20250419~deb12u1~deb11u1~deb10u1~deb9u1 (stretch), issued ELA-1810-1.

This is a backport update in order to get fairly up-to-date CA certificates in Debian stretch. More precisely, it corresponds to Mozilla certificate authority bundle version 2.74.

ca-certificates-java

Debian ELTS: Uploaded 20230710~deb12u1~deb11u1~deb10u2 (buster) and 20230710~deb12u1~deb11u1~deb10u2~deb9u1 (stretch), issued ELA-1809-1.

This is a bugfix update to resolve a circular dependency between Java packages and ca-certificates, and thus clear the way to backport ca-certificates to Debian 9 stretch.

xorg-server

Debian LTS: Uploaded 2:21.1.7-3+deb12u13 (bookworm), issued DLA-4737-1, fixing:

Debian LTS: Uploaded 2:1.20.11-1+deb11u18 (bullseye), issued DLA-4738-1, fixing all the CVEs listed above, plus those 5:

2026, July

dpkg

Uploaded 1.20.14 in Debian LTS, issued DLA-4673-1, fixing:

The actual work on the package was done by Guillem Jover, cf. https://lists.debian.org/debian-dpkg/2026/07/msg00005.html. I did the upload and followed-up with QA checks on https://debusine.debian.net.

openssl

Uploaded 1.1.0l-1~deb9u13 (stretch) and 1.1.1n-0+deb10u10 (buster) for Debian ELTS, issued ELA-1773-1, fixing:

Misc

Debusine: kernel fails to install or upgrade in autopkgtest testbed (bullseye)

Debusine: discuss capabilities in autopkgtest environment, for dpkg package:

Review dnsmasq update for ELTS (with Lukas Märdian):

Review python3.7 update for ELTS (with Emmanuel Arias).

2026, June

glibc

Uploaded 2.31-13+deb11u14 in Debian LTS, issued DLA-4621-1, fixing:

openssl

Uploaded 1.1.1w-0+deb11u7 in Debian LTS, issued DLA-4624-1, fixing:

Uploaded 1.1.1w-0+deb11u8 in Debian LTS, issued DLA-4630-1, fixing:

dnsmasq

Uploaded 2.85-1+deb11u2 in Debian LTS, issued DLA-4625-1, fixing:

Also, synced the Debian test suite with bookworm to increase coverage.

2026, May

python3

Uploaded python3.9/3.9.2-1+deb11u7 in Debian LTS, and issued DLA-4583-1, fixing:

Additionally, I uploaded python3.11/3.11.2-6+deb12u8 in Debian oldstable, cf. #1136382.

libarchive

Uploaded 3.4.3-2+deb11u4 in Debian LTS, and issued DLA-4563-1, fixing:

Additionally, I uploaded the following:

systemd

Version 252.39-1~deb12u2 was uploaded to Debian oldstable, cf. https://tracker.debian.org/news/1748276/accepted-systemd-25239-1deb12u2-source-into-oldstable-proposed-updates/

2026, April

containerd

Uploaded 1.6.20~ds1-1+deb12u3 for Debian bookworm (oldstable). I proposed this new version back in February, cf. #1127704.

systemd

Uploaded 247.3-7+deb11u8 and issued DLA-4533-1:

python3.9

Uploaded 3.9.2-1+deb11u6 and issued DLA-4532-1:

python3.11

Uploaded 3.11.2-6+deb12u7 for Debian bookworm (oldstable), in order to catch up with Debian bullseye (LTS), cf. #1126814.

2026, March

ca-certificates-java

With Bastien Roucaries, we keep making progress on backporting latest versions of ca-certificates and ca-certificates-java in Debian LTS and older.

At this point, and after much research and testing, it seems obvious that GCJ-6 (in Debian ELTS buster) was never meant to work with ca-certificates-java. It's also becoming clear that GCJ-6 should be treated as unsupported, due to numerous issues. For example, its crypto support is severely outdated and hardly usable these days.

Focusing on the only Java runtime left to support (openjdk), we found more issues and we're still working on that.

python

I worked on the proposed upload for Python 3.11 in bookworm (#1126814), and proposed a new version, after feedback from Moritz and Sylvain. This upload addresses a batch of CVEs that were already fixed in LTS, but are not yet in oldstable.

I also worked on the latest batch of Python CVEs, the work is mostly done for Python 3.9, however the patches are not yet merged upstream, and not in Debian either. So for now this work is just sitting in Git, it will be released in LTS when the time is ripe.

python-cryptography

I worked on CVE-2026-26007, the first step being to apply the fix provided by upstream to the package in Debian stable (trixie). However backporting the fix to older versions is more challenging: the code impacted has been rewritten from Python to Rust, and upsteam only fixes the more recent Rust version. So backporting will involve rewritting the patch in Python, which is do-able but requires the right person with the right skills.

Consequently, this CVE was marked as "postponed" for Debian LTS and older, as it doesn't seem any urgent anyway.

2026, February

containerd

Uploaded 1.4.13~ds1-1~deb11u6 and issued DLA-4467-1:

I also reached out to the Debian Release team in order to upload those fixes in Debian oldstable (bookworm), I'm still waiting for feedback.

glib2.0

A number of low severity issues where found in glib. Andreas Henriksson took care of those for Debian stable, oldstable and LTS (bullseye). As part of my onboarding, I reached out to Andreas and asked if I could handle the ELTS uploads (buster, stretch), to which he agreed.

Backporting the patches was trivial, thus I published ELA-1652-1.0 and uploaded 2.50.3-2+deb9u9 in Debian stretch and 2.58.3-2+deb10u10 in Debian buster.

runc

I tried to move forward the discussion regarding the runc package.

There is an ongoing discussion about how to address the latest batch of CVEs that were reported for runc, at #1120140. Backporting the patches doesn't seem to be a realistic option. More generally, the discussion is about how to provide support for this package in Debian stable and older releases.

The maintainer of the runc package did a first assessment and proposed different options for Debian. I tried one of the approaches: to build new versions of runc against older Debian releases. My conclusion is that if we go this way, we shouldn't try to use the Build-Depends from the Debian archive, but we should use the vendor tree from src:runc instead. That could go in a different source package, and this is the approach followed by Ubuntu.

ca-certificates

Backporting ca-certificates to older Debian releases (ELTS) proved challenging, and also includes updates in other related packages: ca-certificates-java and gcc-6 (for stretch).

I worked with Bastien Roucaries on this topic, tested a bunch of scenarios, and uncovered new issues in the process. We're still working on that.