Your message dated Fri, 04 Sep 2020 08:34:02 +0000
with message-id <[email protected]>
and subject line Bug#965982: fixed in haskell-cmark-gfm 0.2.1+ds1-1
has caused the Debian Bug report #965982,
regarding CVE-2020-5238
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
965982: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965982
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: haskell-cmark-gfm
Severity: important
Tags: security
This was assigned CVE-2020-5238
https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85
https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4
And haskell-cmark-gfm seems to embed a copy of cmark-gfm.
Cheers,
Moritz
--- End Message ---
--- Begin Message ---
Source: haskell-cmark-gfm
Source-Version: 0.2.1+ds1-1
Done: Ilias Tsitsimpis <[email protected]>
We believe that the bug you reported is fixed in the latest version of
haskell-cmark-gfm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ilias Tsitsimpis <[email protected]> (supplier of updated haskell-cmark-gfm
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 04 Sep 2020 10:45:40 +0300
Source: haskell-cmark-gfm
Architecture: source
Version: 0.2.1+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Haskell Group
<[email protected]>
Changed-By: Ilias Tsitsimpis <[email protected]>
Closes: 965982
Changes:
haskell-cmark-gfm (0.2.1+ds1-1) unstable; urgency=medium
.
* Remove embedded copy of cmark-gfm library, use libcmark-gfm-dev instead
(CVE-2020-5238, Closes: #965982)
Checksums-Sha1:
28f4cb33f67451baccc284b38e5dc7311fe370f8 2329 haskell-cmark-gfm_0.2.1+ds1-1.dsc
9671effa712e12314653870b691b82adeadbe0f7 19124
haskell-cmark-gfm_0.2.1+ds1.orig.tar.xz
205e16f5f6837117af46303fe6a2b231f4612add 2928
haskell-cmark-gfm_0.2.1+ds1-1.debian.tar.xz
264a2ba75f3c16e7ac3ea441f4dfea4ee666ad48 8054
haskell-cmark-gfm_0.2.1+ds1-1_amd64.buildinfo
Checksums-Sha256:
f8c7957773398b4cc4cc3d84f85c81d1cff300a4b5c47f8135dc772d8408d878 2329
haskell-cmark-gfm_0.2.1+ds1-1.dsc
73508ca44415f7beb0320915862da17db31a434d4e1e5db05993aca83b1f0bf6 19124
haskell-cmark-gfm_0.2.1+ds1.orig.tar.xz
10ec541f7f1b78e8337f656c1a7a8813938c7a2ecfb84231fabc2ec4dd0eac54 2928
haskell-cmark-gfm_0.2.1+ds1-1.debian.tar.xz
0e831aa7a856942b2f905837470149f203f1b50fe9abd27f4c7e04dfdd487c79 8054
haskell-cmark-gfm_0.2.1+ds1-1_amd64.buildinfo
Files:
fc29be26934737cd5b235565aafcc4ee 2329 haskell optional
haskell-cmark-gfm_0.2.1+ds1-1.dsc
efbbea041b2fd747b7c9167c89603377 19124 haskell optional
haskell-cmark-gfm_0.2.1+ds1.orig.tar.xz
28e4ca83b0e4dd4789da08a20f6a2c44 2928 haskell optional
haskell-cmark-gfm_0.2.1+ds1-1.debian.tar.xz
93d15468f37da1deedbe9a084cb53720 8054 haskell optional
haskell-cmark-gfm_0.2.1+ds1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEJ9c8pfW11+AaUTb116hngMxkQDwFAl9R86oUHGlsaWFzdHNp
QGRlYmlhbi5vcmcACgkQ16hngMxkQDy9tg//TdDPH3YK8fFbgD8py+cQpD+UnOxd
cg13CNlS4b62zeTNq4L7XKdW5X1JQ+ju5227aaDbKf8/QRgEWrAu+yKfUqBssQEf
GC137OU8YhGDRTOTawj66mvzFhPWINDKt9YSRJeBexDEL08pxOeRJD4Ok766icQ3
7KWtaLivU2RZfir8gUBsknqnA1Ha+mH2pv4h4lWHDdhiNsjZh5udogP8DGp23GrQ
ZAiLgvFk51inshAq2LIXLPn1maLvnxR9VZOsc2hlDAyxoukM5mhjQvT2gUSSmPuk
TOSrR5sBia29x+3rtCPb7XCTF7jYFaXI/l83HE5vlCxvR42H11box48C6IokrcF8
yBeJLX+RTD0UxJ+nWDMMHsSoX2ZH0g0K7p0TW+heHDcRml3lt7PZFyASqJ+rmmW5
how53KnJk2n1KIZ57jI3gCu5u7MfLlwED2nsqH52rd7m9CUYYQE4vC4qpn2eH+Wc
lmhLfsY2ixBjF/KXUpIDsuUhondmR8KiJUEEH/iNCf0BynTKfDemqJc2wNSVyIZs
isrEd/FLXKqY3hsfU5BK7DM0SLZCCbJpT6RdZd59WUZ2tuI1GDYij2645fjYQea8
TfkBR1BNoEEIXB17+3QzmWxYLgQ8XOA9ND2rpHNMdfYquDo4VdWEmV4yCkP7QEdq
SqO+bjWb144NIf8=
=h25/
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
Pkg-haskell-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-haskell-maintainers
