Debian Patches

Status for memcached/1.6.18-1+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
0001-LSB-requirements.patch LSB requirements Peter Eisentraut <petere@debian.org> not-needed https://bugs.debian.org/528689, https://bugs.debian.org/709163 2016-03-20
0002-Additions-for-service-unit-file.patch Additions for service unit file

- Use wrapper script for /etc/memcached.conf
- Document man page
- Use a pidfile
- Try to automatically restart the service when		 Guillaume Delacour <gui@iroqwa.org> not-needed 2017-09-13
0003-Uses-retry-to-wait-up-to-5-seconds-for-the-killed-pr.patch Uses --retry to wait up to 5 seconds for the killed process to die. Clint Byrum <clint@ubuntu.com> invalid upstream 2017-03-12
0005-Source-etc-default-memcached-in-etc-init.d-memcached.patch Source /etc/default/memcached in /etc/init.d/memcached. (Closes: #934542) Chris Lamb <lamby@debian.org> not-needed 2019-09-06
0006-restore-systemd-sandboxing.patch Restore systemd sandboxing

Upstream regressed systemd sandboxing for everyone by default because RHEL
cannot support it. Put it back again to avoid this functional regression.		 Robie Basak <robie.basak@canonical.com> not-needed upstream 2018-03-13
0007-uninitialized-variables.patch fix an error due to use of a possibly uninitialized variable

gcc detects that this variable may be used without being initialized. Just
initialize it to fix the error.		 Steve Langasek <steve.langasek@ubuntu.com> no 2021-12-08
0008-CVE-2026-47783-CVE-2026-47784.patch Fix timing side-channel in SASL password database authentication
asl_server_userdb_checkpass() broke out of the password file loop
early when a valid username was found, creating a measurable timing
difference between valid and invalid usernames. Additionally, the
password comparison used memcmp() which returns early on the first
differing byte, potentially leaking password bytes via timing analysis.

Fix both issues with minimal changes per reviewer feedback:
- Clear buffer to zero before each fgets so comparisons past the
stored password hit known zero bytes
- Use safe_memcmp() for both username and password comparisons
(constant-time, volatile-qualified)
- Remove the early break so the entire file is always scanned		 Sarthak Munshi <sarthakmunshi@gmail.com> no upstream, https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed.patch 2026-03-21
0009-CVE-2023-46852.patch no
CVE-2023-46853.patch proxy: fix off-by-one if \r is missing
A bunch of the parser assumed we only had \r\n, but I didn't actually
have that strictness set. Some commands worked and some broke in subtle
ways when just "\n" was being submitted.

I'm not 100% confident in this change yet so I'm opening a PR to stage
it while I run some more thorough tests.		 dormando <dormando@rydia.net> no 2023-08-02

All known versions for source package 'memcached'

Links