Bug#1008045: bullseye-pu: package node-mermaid/8.7.0+ds+~cs27.17.17-3+deb11u1
On 21/06/2022 08:30, Salvatore Bonaccorso wrote:
Hi Yadd,
On Sat, May 28, 2022 at 09:20:40PM +0100, Adam D. Barratt wrote:
Control: tags -1 + confirmed
On Mon, 2022-03-21 at 14:09 +0100, Yadd wrote:
node-mermaid is vulnerable to XSS attack (CVE-2021-23648)
Please go ahead.
Could you fix as well CVE-2021-43861 in the next point release? Should
be then on top of the already uploaded +deb11u1.
Regards,
Salvatore
Hi,
done (8.7.0+ds+~cs27.17.17-3+deb11u2), just pushed to Bullseye queue
Regards,
Yadddiff --git a/debian/changelog b/debian/changelog
index 32f71e8..f566922 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+node-mermaid (8.7.0+ds+~cs27.17.17-3+deb11u2) bullseye; urgency=medium
+
+ * Team upload
+ * Fix for XSS vulnerability in url sanitization (Closes: CVE-2021-43861)
+
+ -- Yadd Sat, 02 Jul 2022 07:06:05 +0200
+
node-mermaid (8.7.0+ds+~cs27.17.17-3+deb11u1) bullseye; urgency=medium
* Decode html entities before sanitizing (Closes: CVE-2021-23648)
diff --git a/debian/patches/CVE-2021-43861.patch
b/debian/patches/CVE-2021-43861.patch
new file mode 100644
index 000..418467e
--- /dev/null
+++ b/debian/patches/CVE-2021-43861.patch
@@ -0,0 +1,306 @@
+Description: Fix for XSS vulnerability in url sanitization
+Author: Knut Sveidqvist
+Origin: upstream, https://github.com/mermaid-js/mermaid/commit/066b7a0d
+Bug:
https://github.com/mermaid-js/mermaid/security/advisories/GHSA-p3rp-vmj9-gv6v
+Forwarded: not-needed
+Reviewed-By: Yadd
+Last-Update: 2022-07-02
+
+--- /dev/null
b/cypress/platform/xss16.html
+@@ -0,0 +1,106 @@
++
++
++https://fonts.googleapis.com/css?family=Montserrat=swap;
++ rel="stylesheet"
++/>
++https://unpkg.com/tailwindcss@^1.0/dist/tailwind.min.css;
rel="stylesheet">
++https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css;>
++https://fonts.googleapis.com/css?family=Noto+Sans+SC=swap;
rel="stylesheet">
++
++ body {
++/* background: rgb(221, 208, 208); */
++/* background:#333; */
++font-family: 'Arial';
++/* font-size: 18px !important; */
++}
++ h1 { color: grey;}
++ .mermaid2 {
++display: none;
++ }
++ .mermaid svg {
++/* font-size: 18px !important; */
++ }
++ .malware {
++position: fixed;
++bottom:0;
++left:0;
++right:0;
++height: 150px;
++background: red;
++color: black;
++display: flex;
++display: flex;
++justify-content: center;
++align-items: center;
++font-family: monospace;
++font-size: 72px;
++ }
++
++
++
++Security check
++
++
++
++
++
++ mermaid.parseError = function (err, hash) {
++// console.error('Mermaid error: ', err);
++ };
++ mermaid.initialize({
++theme: 'forest',
++arrowMarkerAbsolute: true,
++// themeCSS: '.edgePath .path {stroke: red;} .arrowheadPath {fill:
red;}',
++logLevel: 0,
++state: {
++ defaultRenderer: 'dagre-d3',
++},
++flowchart: {
++ // defaultRenderer: 'dagre-wrapper',
++ nodeSpacing: 10,
++curve: 'cardinal',
++htmlLabels: true,
++},
++htmlLabels: true,
++// gantt: { axisFormat: '%m/%d/%Y' },
++sequence: { actorFontFamily: 'courier', actorMargin: 50,
showSequenceNumbers: false },
++// sequenceDiagram: { actorMargin: 300 } // deprecated
++// fontFamily: '"times", sans-serif',
++// fontFamily: 'courier',
++fontSize: 18,
++curve: 'basis',
++securityLevel: 'loose',
++startOnLoad: false,
++secure: ['secure', 'securityLevel', 'startOnLoad', 'maxTextSize'],
++// themeVariables: {relationLabelColor: 'red'}
++ });
++ function callback() {
++ alert('It worked');
++}
++ function xssAttack() {
++const div = document.createElement('div');
++div.id = 'the-malware';
++div.className = 'malware';
++div.innerHTML = 'XSS Succeeded';
++document.getElementsByTagName('body')[0].appendChild(div);
++throw new Error('XSS Succeded');
++ }
++
++ var diagram = `sequenceDiagram
++participant Alice
++links Alice: { "Click me!" : "javasjavascript:cript:alert('goose')" }`;
++
++// // var diagram = "stateDiagram-v2\n";
++// // diagram += "
"]';
++// console.log(diagram);
++// document.querySelector('#diagram').innerHTML = diagram;
++mermaid.render('diagram', diagram, (res) => {
++ console.log(res);
++ document.querySelector('#res').innerHTML = res;
++});
++
++
++
++
+--- /dev/null
b/cypress/platform/xss17.html
+@@ -0,0 +1,106 @@
++
++
++https://fonts.googleapis.com/css?family=Montserrat=swap;
++ rel="stylesheet"
++/>
++
Bug#1014206: bullseye-pu: package dpkg/1.20.11
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu Hi! [ Reason ] This request includes several targeted minimal fixes for issues found in dpkg 1.20.10, including one regression introduced in the security update. I mentioned to Adam that I'd prepare two sets of debdiffs, one with just the regression fix and another one with fixes for the other pending RC and other fixes. But after checking them, the latter seemed too big for the amount of time available, and while these have all been in sid for a while they have not been tested on their own, so I think it's probably better to postpone those for a next release, that I'll be preparing once this one is handled. Instead I went with a small set of small targeted fixes. [ Impact ] a) A CI fix, that was causing the branch to fail on salsa. b) The dpkg-deb change fixes handling for truncated .debs. c) The virtual fields one fixes a regression in dpkg --showformat. d) The Dpkg::Source::Package::V2 fixes the regression from the security fix. This affects systems with "unusual" umasks. [ Tests ] a) The CI for that branch is green again. :) b) The commit includes functional tests. c) Running dpkg-deb --showformat with a virtual field now works again. d) The lintian test suite was executed successfully. [ Risks ] The set of changes cherry-picked is focused and easily verifiable. Any bigger/riskier change has been left out. [ Checklist ] [√] *all* changes are documented in the d/changelog [√] I reviewed all changes and I approve them [√] attach debdiff against the package in (old)stable [√] the issue is verified as fixed in unstable [ Changes ] The git log is included in the debdiff, which I'm attaching in its full compressed form with no filtering applied. [ Other info ] None. Thanks, Guillem dpkg-1.20.10-1.20.11.debdiff.xz Description: application/xz
NEW changes in stable-new
Processing changes file: ganeti_3.0.2-1~deb11u1_armhf-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: ganeti_3.0.2-1~deb11u1_s390x-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_armel-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_s390x-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_s390x-buildd.changes ACCEPT Processing changes file: logrotate_3.18.0-2+deb11u1_s390x-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_s390x-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_s390x-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_s390x-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_s390x-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_s390x-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_armel-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: logrotate_3.18.0-2+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: logrotate_3.18.0-2+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: logrotate_3.18.0-2+deb11u1_ppc64el-buildd.changes ACCEPT
Bug#1014200: buster-pu: package ublock-origin/1.37.0+dfsg-1~deb10u1
Package: release.debian.org Severity: normal Tags: buster User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to update the ublock-origin add-on for Firefox and Chromium. This is just a normal update which improves the ability to block ads, malware and trackers and just brings the package up-to-date to be useful for users. There is no risk of breaking unrelated packages. We have done this before and it worked pretty well. The update also corrects a mistake in debian/changelog (#996249) Regards, Markus
Bug#1007714: bullseye-pu: package openssh/1:8.4p1-5+deb11u1
On Wed, Jun 29, 2022 at 10:27:01PM +0100, Adam D. Barratt wrote: > On Fri, 2022-03-18 at 08:43 +0100, Cyril Brulebois wrote: > > Adam D. Barratt (2022-03-17): > > > As openssh builds a udeb, I'm CCing KiBi and tagging the bug > > > accordingly. > > > > Making sure upgrades have a chance to work properly seems more > > important > > than any possible regressions at install time, for those deploying > > over > > SSH, so no objections at all. > > Just a quick reminder on this, as the window for getting changes into > 11.4 closes over the coming weekend. Oops, sorry! I've just uploaded this. -- Colin Watson (he/him) [cjwat...@debian.org]
Bug#1014199: bullseye-pu: package ublock-origin/1.37.0+dfsg-1~deb11u1
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to update the ublock-origin add-on for Firefox and Chromium. This is just a normal update which improves the ability to block ads, malware and trackers and just brings the package up-to-date to be useful for users. There is no risk of breaking unrelated packages. We have done this before and it worked pretty well. The update also corrects a mistake in debian/changelog (#996249) Regards, Markus
NEW changes in stable-new
Processing changes file: composer_2.0.9-2+deb11u1_all-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_all-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_amd64-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_arm64-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_armel-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_armhf-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_i386-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_mips64el-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_mipsel-buildd.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_ppc64el-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_armel-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_i386-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_all-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_amd64-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_arm64-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_armel-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_armhf-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_i386-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_mips64el-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_mipsel-buildd.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_ppc64el-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_all-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_armel-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_i386-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_armel-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_i386-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_all-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_amd64-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_arm64-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_i386-buildd.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_all-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_i386-buildd.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_all-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_armel-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_i386-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_mipsel-buildd.changes ACCEPT
Bug#1008166: bullseye-pu: package debian-edu-config/2.11.56+deb11u4
Hi, On Fr 01 Jul 2022 19:37:54 CEST, Adam D. Barratt wrote: Control: tags -1 + confirmed On Wed, 2022-03-23 at 12:33 +, Mike Gabriel wrote: Hi again, On Mi 23 Mär 2022 13:19:54 CET, Mike Gabriel wrote: > [ Tests ] > (What automated or manual tests cover the affected code?) I forgot to mention the nature of the performed tests. All code changes were tested in the field on at least 2 sometimes 3 Debian Edu production sites. All resolved problems were problems that were encountered in the field on one of my production Debian Edu 11 setups. The solutions / bug fixes were first developed and tested on-premise. Once the wanted functionality was achieved, the changes were provided for Debian Edu testing/unstable and then backported to 2.11.56+deb11u4 of debian-edu-config. The on-premise solutions were then removed and replaced by preview versions of debian-edu-config 2.11.56+deb11u4 and tested again. Sorry for not getting to this sooner. Please go ahead, bearing in mind that the window for getting fixes into 11.4 closes this weekend. Regards, Adam Uploaded just now. (Will take some time to land, probably). Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4351) 486 14 27 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@debian.org, http://sunweavers.net pgpUZqPdBCk8_.pgp Description: Digitale PGP-Signatur
Bug#1013954: transition: opencv
Control: tags -1 confirmed On 2022-07-01 22:15:43, Jochen Sprickerhof wrote: > Control: tags -1 - moreinfo > > Hi Sebastian, > > * Sebastian Ramacher [2022-06-29 00:18]: > > Control: tags -1 moreinfo > > > > On 2022-06-28 00:28:04 +0200, Jochen Sprickerhof wrote: > > > Package: release.debian.org > > > Severity: normal > > > User: release.debian@packages.debian.org > > > Usertags: transition > > > > > > Hi release team, > > > > > > I would like to transition the new opencv version, containing a fix for > > > building with ffmpeg 5.0 (#1004718). > > > > This version however fails to build on mipsel: > > https://buildd.debian.org/status/fetch.php?pkg=opencv=mipsel=4.6.0%2Bdfsg-2=1656417149=0 > > > > Please remove the moreinfo tag once this issue is fixed. > > Seems like I only checked against unstable where it was failing already, > sorry for the confusion. Anyway, it builds again on all release archs and it > would be great to get a transition slot. Please go ahead Cheers > > Cheers Jochen > > > > Cheers > > > > > The autogenerated ben tracker looks > > > fine and I've successfully rebuild all reverse dependencies listed on it > > > except: > > > > > > already ftbfs due to other changes: > > > > > > digikam #1004769 > > > openimageio #1012176 > > > os-autoinst #1013533 > > > pytorch #1004782 > > > > > > newly filled: > > > > > > sight #1013903 > > > > > > Cheers Jochen > > > > > > > -- > > Sebastian Ramacher > > -- Sebastian Ramacher
Processed: Re: Bug#1013954: transition: opencv
Processing control commands: > tags -1 confirmed Bug #1013954 [release.debian.org] transition: opencv Added tag(s) confirmed. -- 1013954: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013954 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: Re: Bug#1013954: transition: opencv
Processing control commands: > tags -1 - moreinfo Bug #1013954 [release.debian.org] transition: opencv Removed tag(s) moreinfo. -- 1013954: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013954 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1013954: transition: opencv
Control: tags -1 - moreinfo Hi Sebastian, * Sebastian Ramacher [2022-06-29 00:18]: Control: tags -1 moreinfo On 2022-06-28 00:28:04 +0200, Jochen Sprickerhof wrote: Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition Hi release team, I would like to transition the new opencv version, containing a fix for building with ffmpeg 5.0 (#1004718). This version however fails to build on mipsel: https://buildd.debian.org/status/fetch.php?pkg=opencv=mipsel=4.6.0%2Bdfsg-2=1656417149=0 Please remove the moreinfo tag once this issue is fixed. Seems like I only checked against unstable where it was failing already, sorry for the confusion. Anyway, it builds again on all release archs and it would be great to get a transition slot. Cheers Jochen Cheers The autogenerated ben tracker looks fine and I've successfully rebuild all reverse dependencies listed on it except: already ftbfs due to other changes: digikam #1004769 openimageio #1012176 os-autoinst #1013533 pytorch #1004782 newly filled: sight #1013903 Cheers Jochen -- Sebastian Ramacher signature.asc Description: PGP signature
NEW changes in stable-new
Processing changes file: linux-signed-amd64_5.10.127+1_source.changes ACCEPT
NEW changes in oldstable-new
Processing changes file: firejail_0.9.58.2-2+deb10u3_source.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_all-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_amd64-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_arm64-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_armel-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_armhf-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_i386-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_mips-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_mips64el-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_mipsel-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_ppc64el-buildd.changes ACCEPT Processing changes file: firejail_0.9.58.2-2+deb10u3_s390x-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_source.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_all-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_amd64-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_arm64-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_armel-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_armhf-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_i386-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_mips-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_mips64el-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_mipsel-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_ppc64el-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb10u3_s390x-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_source.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_all-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_amd64-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_arm64-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_armel-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_armhf-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_i386-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_mips-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_mips64el-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_mipsel-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_ppc64el-buildd.changes ACCEPT Processing changes file: squid_4.6-1+deb10u7_s390x-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_source.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_all-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_amd64-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_arm64-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_armel-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_armhf-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_i386-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_mips-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_mips64el-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_mipsel-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_ppc64el-buildd.changes ACCEPT Processing changes file: vlc_3.0.17.4-0+deb10u1_s390x-buildd.changes ACCEPT
Processed: Re: Bug#1001639: bullseye-pu: package python-hbmqtt/0.9.6-1+deb11u1
Processing commands for cont...@bugs.debian.org: > # BCC control@bugs > user release.debian@packages.debian.org Setting user to release.debian@packages.debian.org (was a...@adam-barratt.org.uk). > usertags 1001639 = rm Usertags were: pu. Usertags are now: rm. > retitle 1001639 RM: python-hbmqtt -- RoQA; broken; low popcon; unmaintained Bug #1001639 [release.debian.org] bullseye-pu: package python-hbmqtt/0.9.6-1+deb11u1 Changed Bug title to 'RM: python-hbmqtt -- RoQA; broken; low popcon; unmaintained' from 'bullseye-pu: package python-hbmqtt/0.9.6-1+deb11u1'. > tags 1001639 -confirmed +pending Bug #1001639 [release.debian.org] RM: python-hbmqtt -- RoQA; broken; low popcon; unmaintained Removed tag(s) confirmed. Bug #1001639 [release.debian.org] RM: python-hbmqtt -- RoQA; broken; low popcon; unmaintained Added tag(s) pending. > thanks Stopping processing here. Please contact me if you need assistance. -- 1001639: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001639 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1001639: bullseye-pu: package python-hbmqtt/0.9.6-1+deb11u1
# BCC control@bugs user release.debian@packages.debian.org usertags 1001639 = rm retitle 1001639 RM: python-hbmqtt -- RoQA; broken; low popcon; unmaintained tags 1001639 -confirmed +pending thanks On Fri, 2022-04-29 at 07:29 +0200, Helmut Grohne wrote: > Hi Adam, > > On Tue, Mar 15, 2022 at 09:15:16PM +, Adam D. Barratt wrote: > > Please go ahead; sorry for the delay. > > In the mean time, hbmqtt has been deleted from unstable as > unmaintained. > As such, I now prefer spending my time on migrating stuff away from > hbmqtt and propose removing the (dysfunctional) package from stable. > The > sooner we get rid of it, the fewer people will try using something > that > isn't sustainable. Do you concur? > > If yes, can you directly turn this bug into an appropriate RM > request? Let's do that then. Regards, Adam
Bug#1004459: bullseye-pu: package lxc/1:4.0.6-2+deb11u1
On Sun, 2022-02-20 at 19:38 -0300, Antonio Terceiro wrote: > On Sat, Feb 19, 2022 at 06:53:52PM +, Adam D. Barratt wrote: > > Control: tags -1 + confirmed > > > > On Thu, 2022-01-27 at 21:32 -0300, Antonio Terceiro wrote: > > > This update fixes the download of container images using the > > > "download" > > > template. pool.sks-keyservers.net is not active anymore, so the > > > patch > > > (already included in the upstream release present in > > > sid/bookworm) > > > changes that to keyserver.ubuntu.com. > > > > > > > + * lxc-download: Switch GPG server. > > +The default server used to download gpg keys from has ben > > deprecated, > > > > s/ben/been/ > > > > Please go ahead. > > Uploaded with that typo fixed. Thanks. I was just looking through some older p-u bugs, and realised that this was still open. Looking further, the package never seems to have made it to stable-new. I can't find any mention of the upload in the dak logs on ftp-master, and all I can see on the upload host is: Feb 20 21:55:04 > rm --searchdirs lxc_4.0.6-2+deb11u1_source.changes Feb 20 21:55:04 Files removed: lxc_4.0.6-2+deb11u1_source.changes Feb 20 21:55:04 > rm --searchdirs lxc_4.0.6-2+deb11u1.dsc Feb 20 21:55:04 Files removed: lxc_4.0.6-2+deb11u1.dsc Feb 20 21:55:04 > rm --searchdirs lxc_4.0.6-2+deb11u1.debian.tar.xz Feb 20 21:55:04 Files removed: lxc_4.0.6-2+deb11u1.debian.tar.xz Feb 20 21:55:04 > rm --searchdirs lxc_4.0.6-2+deb11u1_source.buildinfo Feb 20 21:55:04 Files removed: lxc_4.0.6-2+deb11u1_source.buildinfo Regards, Adam
Bug#993796: bullseye-pu: package knot-resolver/5.3.1-1
On Fri, 2021-12-03 at 16:59 +0100, Julien Cristau wrote: > Control: tag -1 confirmed > > On Mon, Sep 06, 2021 at 04:21:15PM +, Jakub Ružička wrote: > > [ Reason ] > > Fixing bug #991463 (CVE-2021-40083) - potential DoS. [...] > Feel free to go ahead and upload, thank you. Ping? Regards, Adam
Processed: Re: Bug#1012553: bullseye-pu: package apache2/2.4.54-1~deb11u1
Processing control commands: > tags -1 + confirmed Bug #1012553 [release.debian.org] bullseye-pu: package apache2/2.4.54-1~deb11u1 Added tag(s) confirmed. -- 1012553: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012553 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1012553: bullseye-pu: package apache2/2.4.54-1~deb11u1
Control: tags -1 + confirmed
On Thu, 2022-06-09 at 09:16 +0200, Yadd wrote:
> Apache2 2.4.54 fixes several security issues:
> * moderate: mod_proxy_ajp: Possible request smuggling (CVE-2022-
> 26377)
>Inconsistent Interpretation of HTTP Requests ('HTTP Request
> Smuggling')
>vulnerability in mod_proxy_ajp of Apache HTTP Server allows an
> attacker
>to smuggle requests to the AJP server it forwards requests to.
> * low: read beyond bounds in mod_isapi (CVE-2022-28330)
> * low: read beyond bounds via ap_rwrite() (CVE-2022-28614)
> * low: Read beyond bounds in ap_strcmp_match() (CVE-2022-28615)
> * low: Denial of service in mod_lua r:parsebody (CVE-2022-29404)
> * low: mod_sed denial of service (CVE-2022-30522)
> * low: Information Disclosure in mod_lua with websockets (CVE-2022-
> 30556)
> * low: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
> (CVE-2022-31813)
>
Please go ahead, bearing in mind that the window for getting uploads
into the 11.4 point release closes during this weekend.
Regards,
Adam
Bug#1013632: [Pkg-raspi-maintainers] Bug#1013632: bullseye-pu: package raspi-firmware/1.20210303+ds-3
Hi Cyril, On Fri, 2022-06-24 at 14:56 +0200, Cyril Brulebois wrote: > I'll follow up with an updated patch once I've performed some more > testing. Did you have chance to look at that yet? I realise that the above message was only a week ago, I'm just wondering if we might be looking at this for 11.4 still, as uploads for that close during this weekend. Regards, Adam
Processed: Re: Bug#1010203: bullseye-pu: package bind9/1:9.16.28-1~deb11u1
Processing control commands: > tags -1 + confirmed Bug #1010203 [release.debian.org] bullseye-pu: package bind9/1:9.16.28-1~deb11u1 Added tag(s) confirmed. -- 1010203: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010203 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1010203: bullseye-pu: package bind9/1:9.16.28-1~deb11u1
Control: tags -1 + confirmed On Tue, 2022-04-26 at 11:00 +0200, Ondřej Surý wrote: > New upstream version update, the upstream CHANGES are: > > --- 9.16.28 released --- > [...] > FTR I am BIND 9 packager and upstream at the same time. There were > no reports > of regressions from the users using BIND 9.16.28 from ISC provided > packages or > compiled from source. Sorry for the delay in getting to this. Please go ahead, bearing in mind that the window for getting uploads into the 11.4 point release closes during this weekend. Regards, Adam
Processed: Re: Bug#1008166: bullseye-pu: package debian-edu-config/2.11.56+deb11u4
Processing control commands: > tags -1 + confirmed Bug #1008166 [release.debian.org] bullseye-pu: package debian-edu-config/2.11.56+deb11u4 Added tag(s) confirmed. -- 1008166: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008166 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1008166: bullseye-pu: package debian-edu-config/2.11.56+deb11u4
Control: tags -1 + confirmed On Wed, 2022-03-23 at 12:33 +, Mike Gabriel wrote: > Hi again, > > On Mi 23 Mär 2022 13:19:54 CET, Mike Gabriel wrote: > > > [ Tests ] > > (What automated or manual tests cover the affected code?) > > I forgot to mention the nature of the performed tests. All code > changes were tested in the field on at least 2 sometimes 3 Debian > Edu > production sites. > > All resolved problems were problems that were encountered in the > field > on one of my production Debian Edu 11 setups. The solutions / bug > fixes were first developed and tested on-premise. Once the wanted > functionality was achieved, the changes were provided for Debian > Edu > testing/unstable and then backported to 2.11.56+deb11u4 of > debian-edu-config. The on-premise solutions were then removed and > replaced by preview versions of debian-edu-config 2.11.56+deb11u4 > and > tested again. > Sorry for not getting to this sooner. Please go ahead, bearing in mind that the window for getting fixes into 11.4 closes this weekend. Regards, Adam
NEW changes in stable-new
Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_source.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_all-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_armel-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_i386-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: asterisk_16.16.1~dfsg-1+deb11u1_s390x-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: composer_2.0.9-2+deb11u1_source.changes ACCEPT Processing changes file: cyrus-imapd_3.2.6-2+deb11u2_sourceonly.changes ACCEPT Processing changes file: dbus-broker_26-1+deb11u1_source.changes ACCEPT Processing changes file: docker.io_20.10.5+dfsg1-1+deb11u2_source.changes ACCEPT Processing changes file: freetype_2.10.4+dfsg-1+deb11u1_source.changes ACCEPT Processing changes file: fribidi_1.0.8-2+deb11u1_source.changes ACCEPT Processing changes file: ganeti_3.0.2-1~deb11u1_source.changes ACCEPT Processing changes file: gnutls28_3.7.1-5+deb11u1_multi.changes ACCEPT Processing changes file: libsdl2_2.0.14+dfsg2-3+deb11u1_source.changes ACCEPT Processing changes file: logrotate_3.18.0-2+deb11u1_source.changes ACCEPT Processing changes file: node-got_11.8.1+~cs53.13.17-3+deb11u1_sourceonly.changes ACCEPT Processing changes file: phpmyadmin_5.0.4+dfsg2-2+deb11u1_source.changes ACCEPT Processing changes file: usb.ids_2022.05.20-0+deb11u1_source.changes ACCEPT Processing changes file: wireless-regdb_2022.04.08-2~deb11u1_source.changes ACCEPT
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_arm64-buildd.changes ACCEPT
Processed: wireless-regdb 2022.04.08-2~deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1014079 = bullseye pending Bug #1014079 [release.debian.org] bullseye-pu: package wireless-regdb/2022.04.08-2~deb11u1 Added tag(s) pending. > thanks Stopping processing here. Please contact me if you need assistance. -- 1014079: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014079 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: phpmyadmin 5.0.4+dfsg2-2+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1013237 = bullseye pending Bug #1013237 [release.debian.org] bullseye-pu: package phpmyadmin/4:5.0.4+dfsg2-2+deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1013237: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013237 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: node-got 11.8.1+~cs53.13.17-3+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1014054 = bullseye pending Bug #1014054 [release.debian.org] bullseye-pu: package node-got/11.8.1+~cs53.13.17-3+deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1014054: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014054 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: usb.ids 2022.05.20-0+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1014014 = bullseye pending Bug #1014014 [release.debian.org] bullseye-pu: package usb.ids/2022.05.20-0+deb11u1 Added tag(s) pending. > thanks Stopping processing here. Please contact me if you need assistance. -- 1014014: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014014 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: logrotate 3.18.0-2+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1004580 = bullseye pending Bug #1004580 [release.debian.org] bullseye-pu: package logrotate/3.18.0-2 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1004580: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004580 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: libsdl2 2.0.14+dfsg2-3+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1013306 = bullseye pending Bug #1013306 [release.debian.org] bullseye-pu: package libsdl2/2.0.14+dfsg2-3+deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1013306: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013306 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: gnutls28 3.7.1-5+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1012033 = bullseye pending Bug #1012033 [release.debian.org] bullseye-pu: package gnutls28/3.7.1-5+deb11u1 Added tag(s) pending. > thanks Stopping processing here. Please contact me if you need assistance. -- 1012033: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012033 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: ganeti 3.0.2-1~deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1013755 = bullseye pending Bug #1013755 [release.debian.org] bullseye-pu: package ganeti/3.0.2-1~deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1013755: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013755 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: fribidi 1.0.8-2+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1009250 = bullseye pending Bug #1009250 [release.debian.org] bullseye-pu: fribidi/1.0.8-2+deb11u1 Added tag(s) pending; removed tag(s) d-i and confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1009250: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009250 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: freetype 2.10.4+dfsg-1+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1010304 = bullseye pending Bug #1010304 [release.debian.org] bullseye-pu: package freetype/2.10.4+dfsg-1+deb11u1 Added tag(s) pending; removed tag(s) confirmed and d-i. > thanks Stopping processing here. Please contact me if you need assistance. -- 1010304: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010304 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: docker.io 20.10.5+dfsg1-1+deb11u2 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1012140 = bullseye pending Bug #1012140 [release.debian.org] bullseye-pu: package docker.io/20.10.5+dfsg1-1+deb11u2 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1012140: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012140 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: dbus-broker 26-1+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1013418 = bullseye pending Bug #1013418 [release.debian.org] bullseye-pu: package dbus-broker/26-1+deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1013418: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013418 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: cyrus-imapd 3.2.6-2+deb11u2 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1013944 = bullseye pending Bug #1013944 [release.debian.org] bullseye-pu: package cyrus-imapd/3.2.6-2+deb11u2 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1013944: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013944 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: composer 2.0.9-2+deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1012047 = bullseye pending Bug #1012047 [release.debian.org] bullseye-pu: package composer/2.0.9-2+deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1012047: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012047 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1014054: node-got 11.8.1+~cs53.13.17-3+deb11u1 flagged for acceptance
package release.debian.org tags 1014054 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: node-got Version: 11.8.1+~cs53.13.17-3+deb11u1 Explanation: don't allow redirection to Unix socket [CVE-2022-33987]
Bug#1014079: wireless-regdb 2022.04.08-2~deb11u1 flagged for acceptance
package release.debian.org tags 1014079 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: wireless-regdb Version: 2022.04.08-2~deb11u1 Explanation:
Bug#1014014: usb.ids 2022.05.20-0+deb11u1 flagged for acceptance
package release.debian.org tags 1014014 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: usb.ids Version: 2022.05.20-0+deb11u1 Explanation: new upstream release; update included data
Bug#1013755: ganeti 3.0.2-1~deb11u1 flagged for acceptance
package release.debian.org tags 1013755 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: ganeti Version: 3.0.2-1~deb11u1 Explanation: new upstream release; fix several upgrade issues; fix live migration with QEMU 4 and "security_model" of "user" or "pool"
Bug#1013418: dbus-broker 26-1+deb11u1 flagged for acceptance
package release.debian.org tags 1013418 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: dbus-broker Version: 26-1+deb11u1 Explanation: fix buffer overflow issue [CVE-2022-31212]
Bug#1013944: cyrus-imapd 3.2.6-2+deb11u2 flagged for acceptance
package release.debian.org tags 1013944 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: cyrus-imapd Version: 3.2.6-2+deb11u2 Explanation: ensure that all mailboxes have a "uniqueid" field, fixing upgrades to version 3.6
Bug#1013237: phpmyadmin 5.0.4+dfsg2-2+deb11u1 flagged for acceptance
package release.debian.org tags 1013237 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: phpmyadmin Version: 5.0.4+dfsg2-2+deb11u1 Explanation: fix some SQL queries generating a server error
Bug#1012140: docker.io 20.10.5+dfsg1-1+deb11u2 flagged for acceptance
package release.debian.org tags 1012140 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: docker.io Version: 20.10.5+dfsg1-1+deb11u2 Explanation: order docker.service after containerd.service to fix shutdown of containers; explicitly pass the containerd socket path to dockerd to make sure it doesn't start containerd on its own
Bug#1012047: composer 2.0.9-2+deb11u1 flagged for acceptance
package release.debian.org tags 1012047 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: composer Version: 2.0.9-2+deb11u1 Explanation: fix code injection issue [CVE-2022-24828]; update GitHub token pattern
Bug#1013306: libsdl2 2.0.14+dfsg2-3+deb11u1 flagged for acceptance
package release.debian.org tags 1013306 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: libsdl2 Version: 2.0.14+dfsg2-3+deb11u1 Explanation: avoid out-of-bounds read while loading malformed BMP file [CVE-2021-33657], and during YUV to RGB conversion
Bug#1012033: gnutls28 3.7.1-5+deb11u1 flagged for acceptance
package release.debian.org tags 1012033 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: gnutls28 Version: 3.7.1-5+deb11u1 Explanation: fix SSSE3 SHA384 miscalculation; fix null pointer deference issue [CVE-2021-4209]
Bug#1010304: freetype 2.10.4+dfsg-1+deb11u1 flagged for acceptance
package release.debian.org tags 1010304 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: freetype Version: 2.10.4+dfsg-1+deb11u1 Explanation: fix buffer overflow issue [CVE-2022-27404]; fix crashes [CVE-2022-27405 CVE-2022-27406]
Bug#1009250: fribidi 1.0.8-2+deb11u1 flagged for acceptance
package release.debian.org tags 1009250 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: fribidi Version: 1.0.8-2+deb11u1 Explanation: fix buffer overflow issues [CVE-2022-25308 CVE-2022-25309]; fix crash [CVE-2022-25310]
Bug#1004580: logrotate 3.18.0-2+deb11u1 flagged for acceptance
package release.debian.org tags 1004580 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: logrotate Version: 3.18.0-2+deb11u1 Explanation: skip locking if state file is world-readable [CVE-2022-1348]; make configuration parsing stricter in order to avoid parsing foreign files such as core dumps
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_mips64el-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: openssl_1.1.1n-0+deb11u3_source.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_all-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_amd64-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_arm64-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_armel-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_armhf-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_i386-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_mips64el-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_mipsel-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_ppc64el-buildd.changes ACCEPT Processing changes file: openssl_1.1.1n-0+deb11u3_s390x-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_source.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_all-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_amd64-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_arm64-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_armel-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_armhf-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_i386-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_mips64el-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_mipsel-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_ppc64el-buildd.changes ACCEPT Processing changes file: squid_4.13-10+deb11u1_s390x-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_armhf-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_amd64-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: linux_5.10.127-1_armel-buildd.changes ACCEPT Processing changes file: linux_5.10.127-1_i386-buildd.changes ACCEPT
