On 2021/10/05 19:15, Sebastiaan Couwenberg <[email protected]> wrote: > tags 995785 upstream > forwarded 995785 https://github.com/MapServer/MapServer/pull/6418 > > You should get CVEs for these security issues, then they will be tracked > more appropriately than with this bugreport.
Huh, what a strange justification to close a bug report about security vulnerabilities. I'm not interested in tracking this issue - it's already tracked upstream, and my PR has already been approved. I wanted to help the Debian project to ship a vulnerabiity fix in its version-frozen stable releases. A regular new upstream release will not land in Bullseye, and without me telling you, it is unlikely that Debian users will ever receive those fixes. The last time I fixed vulnerabilities in MapServer (May 4th), the fixes didn't land in Debian either. Debian Bullseye shipped with a vulnerable MapServer version. MapServer 7.6.4 was released on July 12th with my vulnerability fixes, but Debian Bullseye was released a month later with the known-vulnerable version 7.6.2. Max _______________________________________________ Pkg-grass-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-grass-devel
