Hi,
On 21/09/2026 10:09, Mathias Behrle wrote:
* Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Sat, 19 Sep
2026 18:13:24 +0200):
I suggest you coordinate with the weasyprint maintainer to decide
whether to backport fixes/features, or try and bump the version in bookworm.
Would it be allowed to have a newer version in bookworm than in stable?
No, because that would break dist upgrades.
However if you're going to fix this in bookworm it is expected that you
fix it in the other dists too :)
Special Debian version '-0+reallyX.Y.Z' (X.Y.Z being the new upstream
version) can also be used for such stable backports, depending on the
situation.
Also this needs a TEMP (CVE-2026-XXXX) entry in the security tracker.
Would you do that or does this need the the security team?
This concerns all dists so please either add this directly as
maintainer, or coordinate with the Security Team ([email protected] or
the public list [email protected]).
There is no other workaround than just to not use the modules
marketing_automation and marketing_email, which allow users to write their
own genshi templates (if we only look at Tryton standard modules). I just
get aware that those modules were not yet available in Tryton series 6.0.
So for me it will be better to not apply the server patch even if the
underlying problem will remain unfixed (and there is a probably negligible
probability that someone uses the feature in own custom modules).
It sounds like TEMP-0000000-9D9504/bookworm could be marked <ignored> in
the security tracker with the above rationale (complex backport and not
used by shipped modules). Do you want to do that?
I would go this way, yes.
OK added
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2a2225a
Cheers!
Sylvain Beucler
Debian LTS Team
