[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510)



On Wed, 23 Feb 2022, Thorsten Glaser wrote:

On Tue, 22 Feb 2022, Thomas Uhle wrote:

> What do you think, wouldn't it be time for an update in Debian?

The comment
> at https://github.com/beanshell/beanshell/issues/603 .
reads for me more like a “maybe remove it instead…”.

Honestly though, if it’s not available in Central, upstreams will
not use it and stick to old beta versions. If Debian has a newer
one, which may be incompatible, we’re inviting problems.

That might be true although the BeanShell developers claim in their announcment of version 2.1.0 to be backward compatible with version 2.0b6, and only suitable backports from the upcoming version 3.0 of BeanShell have made it into version 2.1.0. But even then Debian could move on to version 2.0b6 at least. It is the latest version of BeanShell on Maven Central.

Perhaps we might have a better picture after a look at other Linux distributions. Arch, Fedora and Mageia for instance already have version 2.1.0 onboard whereas Gentoo, OpenMandriva, openSUSE and Red Hat stay with version 2.0b6 (... to name just a few). So it is quite mixed. But I haven't seen any Linux distribution so far (apart from those derived from Debian like Linux Mint, Ubuntu, etc.) that still have version 2.0b4. It seems that both decisions (either to update to version 2.1.0 or to version 2.0b6) are reasonable.

Best regards,

Thomas Uhle

Reply to: