Bug#933002: docker.io: CVE-2019-13139

2019-09-10 Thread Adam D. Barratt
On Sun, 2019-08-18 at 16:22 +0100, Adam D. Barratt wrote: > On Sun, 2019-08-18 at 16:56 +0200, Arnaud Rebillout wrote: > > * The bug you want to fix in stable must be fixed in unstable > > already (and not waiting in NEW or the delayed queue) > > > > My issue with this particular bug

Bug#933002: docker.io: CVE-2019-13139

2019-08-18 Thread Adam D. Barratt
On Sun, 2019-08-18 at 16:56 +0200, Arnaud Rebillout wrote: > * The bug you want to fix in stable must be fixed in unstable >   already (and not waiting in NEW or the delayed queue) > > My issue with this particular bug (#933002) is that for now, > docker.io  doesn't build in unstable. It

Bug#933002: docker.io: CVE-2019-13139

2019-08-18 Thread Arnaud Rebillout
  Dear Release Team, I'm new to the process of uploading to stable, I need your guidance on that one. From the buster announce:    * The bug you want to fix in stable must be fixed in unstable  already (and not waiting in NEW or the delayed queue) My issue with this particular bug

Bug#933002: docker.io: CVE-2019-13139

2019-08-15 Thread Arnaud Rebillout
On 8/13/19 12:35 PM, Salvatore Bonaccorso wrote: On Tue, Aug 13, 2019 at 11:31:41AM +0200, Arnaud Rebillout wrote: This is fixed in unstable. Thanks! Oh well, not fixed in unstable yet actually, as the package doesn't build anymore due to changes in the dependency tree... This one is

Bug#933002: docker.io: CVE-2019-13139

2019-08-13 Thread Salvatore Bonaccorso
Hi On Tue, Aug 13, 2019 at 11:31:41AM +0200, Arnaud Rebillout wrote: > This is fixed in unstable. Thanks! > Question from a non-experienced DM: what's the procedure to get this > into stable? It seems that I shouldn't file a bug to release.debian.org, > and instead get in touch with the

Bug#933002: docker.io: CVE-2019-13139

2019-08-13 Thread Arnaud Rebillout
This is fixed in unstable. Question from a non-experienced DM: what's the procedure to get this into stable? It seems that I shouldn't file a bug to release.debian.org, and instead get in touch with the security team. What's the workflow? Should I file a bug against the pseudo-package

Bug#933002: docker.io: CVE-2019-13139

2019-07-25 Thread Salvatore Bonaccorso
Source: docker.io Version: 18.09.1+dfsg1-7.1 Severity: grave Tags: security upstream Forwarded: https://github.com/moby/moby/pull/38944 Control: fixed -1 18.09.5+dfsg1-1 Hi, The following vulnerability was published for docker.io. CVE-2019-13139[0]: command injection due to a missing validation