During this month, I have worked on the following tasks for Debian LTS and ELTS.
Thanks to Freexian and sponsors for making this possible [0].

nghttp2

• Follow-up on CVE-2026-27135
• Fixed Debusine CI in bullseye branch, by adding the tzdata test-dep
• Getting approval from the Security Team, landing DSA-6266-1 for (old)stable:
  https://lists.debian.org/debian-security-announce/2026/msg00177.html
• Published the corresponding DLA-4581-1 for bullseye:
  https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html
• Getting the buster/stretch ELTS branches reviewed & approved (thanks rouca!)
• Final testing/validation/migration of the ELTS packages via chdist & chroot
• Published the corresponding ELA-1735-1 for buster/stretch:
  https://www.freexian.com/lts/extended/updates/ela-1735-1-nghttp2/

Misc

• Participated in the monthly LTS/ELTS team meeting.
• Landing “LTS Team” simplification for “dch –lts” and documentation change
• https://salsa.debian.org/debian/devscripts/-/merge_requests/640

Cheers,
Lukas

[0] https://www.freexian.com/lts/debian/#sponsors

During this month, I have worked on the following tasks for Debian LTS and ELTS.
Thanks to Freexian and sponsors for making this possible [0].

nghttp2

• Investigated CVE-2026-27135 for trixie, bookworm, bullseye, buster & stretch
• preparing backports for E/LTS,
  https://salsa.debian.org/lts-team/packages/nghttp2/-/merge_requests/{1,2,3}
• preparing backports for the security team,
  https://salsa.debian.org/debian/nghttp2/-/merge_requests/{11,12}
• Ongoing coordination with security team and upstream maintainer,
  https://lists.debian.org/debian-security/2026/04/msg00005.html
• Testing and validation of patches inside containers & debusine, incl. a
  written test plan (in MR).
• There’s still an (unrelated) test failure in bullseye on Debusine, that
  cannot be reproduced locally and needs to be investigated.
• transition of nghttp2 lts-team repositories together with @santiago
• Bullseye patches reviewed by @roucha, thanks!

Misc

• Attended the monthly LTS/ELTS team meeting.
• Prepare “LTS Security Team” => “LTS Team” transition for d/changelog NMU
• https://salsa.debian.org/lts-team/lts-team.pages.debian.net/-/merge_requests/33
• https://salsa.debian.org/debian/devscripts/-/merge_requests/640

Cheers,
Lukas

[0] https://www.freexian.com/lts/debian/#sponsors

March 2026

During this month, I have worked on the following tasks for Debian LTS and ELTS.
This was my first month as LTS/ELTS contributor, including technical onboarding
and initial setup of workflows.
Thanks to Freexian and sponsors for making this possible [0].

Asterisk

• Investigated CVE-2026-23738, CVE-2026-23739, CVE-2026-23740 & CVE-2026-23741
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1127438
• Research if it’s possible to harden CVE-2026-23740 by using systemd’s PrivateTmp= hardening
  • No, as “ast_coredumper” is not run as part of the asterisk.service scope.
• Backported upstream patches from “certified-20.9” to v16.28.0 (bullseye/LTS)
• https://github.com/asterisk/asterisk/compare/certified-20.7-cert8…certified-20.7-cert9
• https://salsa.debian.org/lts-team/packages/asterisk/-/merge_requests/1
• Testing and validation of patches inside a bullseye container, incl. a written test plan (in MR) and passing autopkgtests via Debusine workflow.
• https://debusine.debian.net/debian/developers/work-request/531530/
• Cherry-picked patches for buster ELTS (using the same upstream version)
• https://salsa.debian.org/lts-team/packages/asterisk/-/merge_requests/2
• https://debusine.freexian.com/freexian/elts-staging/work-request/149783/
• Stopped work on this after understanding there are no users for asterisk in ELTS as per ela-needed.txt
• Patches reviewed by @apo, thanks!
• Published as DLA-4515-1

Misc

• Initial technical onboarding/setup of LTS/ELTS repositories.
• Spent some time experimenting with Debusine to utilize it for LTS/ELTS work.
• Attended the monthly LTS/ELTS team meeting.

Cheers,
Lukas

[0] https://www.freexian.com/lts/debian/#sponsors

During this month, I have worked on the following tasks for Debian LTS and ELTS.
This was my initial contact with the LTS/ELTS project and preparation of security updates.
Thanks to Freexian and sponsors for making this possible [0].

Log4cxx

• Investigated CVE-2025-54812 & CVE-2025-54813
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111879
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111881
• Backported upstream patches from PR#{509,512,514} to v0.11.0-2 (bullseye/LTS)
• https://salsa.debian.org/debian/log4cxx/-/merge_requests/2
• Testing and validation of patches inside a bullseye container, incl. a written
  test plan (in MR) and passing autopkgtests via SalsaCI pipeline.
• https://salsa.debian.org/slyon/log4cxx/-/pipelines/948717
• Landing the same security fixes in Debian testing & stable, to retain a solid
  upgrade path.
• https://salsa.debian.org/debian/log4cxx/-/merge_requests/1
• https://salsa.debian.org/debian/log4cxx/-/merge_requests/3
• Patches reviewed by @tobi, thanks!
• Published as DLA-4322-1

Cheers,
Lukas

[0] https://www.freexian.com/lts/debian/#sponsors