Hi Ervin, On Fri, Oct 02, 2026 at 12:39:26PM +0200, Ervin Hegedüs wrote: > Hi Salvatore, > > thank you for opening this issue. I've been planning to make new > packages soon (probably today or tomorrow at least), but I hadn't > have enough time since the new releases. (Note, that there are > two affected packages: modsecurity and modsecurity-apache. The > first one has 8 issues, the second one has 6 from those 8.)
Yes, I filled a seperate bug for the src:modsecurity-apache issues. > Regarding to the new packages: a few issues above (as you listed > them) don't have CVE ID's, only Github advisories. The reason is > simple: we requested CVE ID's through GH months ago, but still > haven't got them (for one, we received that yesterday). > > What should I put into the d/changelog in these case? The > advisory ID is enough? Or should I put this issue ID? Or will you > open a DSA (or more?) Right to help us doing tracking, if there are no CVE available yet then please at least mention the GHSA's that would be great (and closing the respective filled bugs as well). Not yet sure if we will release a DSA or a point release update is enough, we will need to assess the severities of the issues. Regards, Salvatore
