Hi,
On 17/10/2026 19:51, Santiago Ruano Rincón wrote:
El 01/10/26 a las 02:57, Andreas Henriksson escribió:
[snip]
## gawk
Did some initial work to backport patches for the outstanding CVEs
as requested in dla-needed.txt for both unstable/testing and bullseye, but
since unstable/testing/... was also unfixed discussion proceeded in
[bts#1142071] and stalled.
[snip]
As of today, gawk has four CVE open: CVE-2026-40467, CVE-2026-40468,
CVE-2026-40469 and CVE-2026-40553. They have been marked as <no-dsa> by
the sec team for trixie, and none of them as a severity >= high.
As a first comment, I wonder if gawk should be listed in dla-needed.txt.
That was a Front Desk decision, but I think we can defer a bookworm
update, marking the CVEs as <no-dsa> (postponed), and removing gawk from
the work queue. There are packages with more important CVEs that are
needing our attention. Andreas, if you agree, would you mind applying
the changes please? Otherwise, please, let me know.
Second, regarding the unstable NMU, while I value that we can contribute
to more recent releases, given the severity of the gawk issues, I think
it is important to give maintainer(s) time to prepare the update.
Especially when the maintainers are active Debian contributors.
Actually, in our context, unstable NMUs should be exceptional, and for
very severe cases.
As a general comment, my suggestion is also to contact the maintainers
first before preparing a stable point update. That also helps to avoid
double work in case they are already preparing the update. TTBOMK,
contrary to *la-needed.txt, there is no general method to know when
somebody is working on an unstable update or stable pu.
Does the above make sense?
+1.
Generally, unless vulnerabilities appear particularly sensitive to us,
we shouldn't add a package to dla-needed.txt until the security team had
a first pass triage. This kind of package can remain present in
lts-cve-triage.py for a few days, even if that crosses a FD shift.
Cheers!
Sylvain
