Hi,
Thanks for the additional info,
On 19/09/2026 11:20, Mathias Behrle wrote:
* Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Fri, 18 Sep
2026 16:12:27 +0200):
On 17/09/2026 12:14, Mathias Behrle wrote:
weasyprint is marked as no DSA for trixie and bookworm for
https://security-tracker.debian.org/tracker/CVE-2025-68616
Bumping weasyprint would solve as well
https://security-tracker.debian.org/tracker/CVE-2026-49452
I suggest you coordinate with the weasyprint maintainer to decide
whether to backport fixes/features, or try and bump the version in bookworm.
Also this needs a TEMP (CVE-2026-XXXX) entry in the security tracker.
There is no other workaround than just to not use the modules
marketing_automation and marketing_email, which allow users to write their own
genshi templates (if we only look at Tryton standard modules). I just get aware
that those modules were not yet available in Tryton series 6.0. So for me it
will be better to not apply the server patch even if the underlying problem
will remain unfixed (and there is a probably negligible probability that
someone uses the feature in own custom modules).
It sounds like TEMP-0000000-9D9504/bookworm could be marked <ignored> in
the security tracker with the above rationale (complex backport and not
used by shipped modules). Do you want to do that?
Cheers!
Sylvain Beucler
Debian LTS Team
