* Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Sat, 19 Sep 2026 18:13:24 +0200):
Hi, > On 19/09/2026 11:20, Mathias Behrle wrote: > > * Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Fri, 18 > > Sep 2026 16:12:27 +0200): > >> On 17/09/2026 12:14, Mathias Behrle wrote: > > weasyprint is marked as no DSA for trixie and bookworm for > > https://security-tracker.debian.org/tracker/CVE-2025-68616 > > > > Bumping weasyprint would solve as well > > https://security-tracker.debian.org/tracker/CVE-2026-49452 > > I suggest you coordinate with the weasyprint maintainer to decide > whether to backport fixes/features, or try and bump the version in bookworm. Would it be allowed to have a newer version in bookworm than in stable? > Also this needs a TEMP (CVE-2026-XXXX) entry in the security tracker. Would you do that or does this need the the security team? > > There is no other workaround than just to not use the modules > > marketing_automation and marketing_email, which allow users to write their > > own genshi templates (if we only look at Tryton standard modules). I just > > get aware that those modules were not yet available in Tryton series 6.0. > > So for me it will be better to not apply the server patch even if the > > underlying problem will remain unfixed (and there is a probably negligible > > probability that someone uses the feature in own custom modules). > > It sounds like TEMP-0000000-9D9504/bookworm could be marked <ignored> in > the security tracker with the above rationale (complex backport and not > used by shipped modules). Do you want to do that? I would go this way, yes. Cheers, Mathias -- Mathias Behrle PGP/GnuPG key availabable from any keyserver, ID: 0xD6D09BE48405BBF6 AC29 7E5C 46B9 D0B6 1C71 7681 D6D0 9BE4 8405 BBF6
pgpctSUQ8JDJF.pgp
Description: Digitale Signatur von OpenPGP
