Re: libseccomp2 CVE fixed only for buster-backports?
On Sat, Jul 11, 2020 at 06:39:37PM +0200, Harald Dunkel wrote:
> Hi folks,
>
> AFAICS CVE-2019-9893 (#924646) was fixed in libseccomp2 2.4.1-1 for
> Unstable, but for Buster there is only a backport. For Stretch there
> is no fix at all. According to #924646 the CVE affects systemd.
>
> I was told before on this list that backports is not intended to fix
> bugs (which implies security fixes), so I wonder WTH?
someone told you nonsense.
https://backports.debian.org/FAQ/
"When security related bugs are fixed in Debian unstable the backporter
is permitted to upload the package from directly there instead of
having to wait until the fix hits testing."
Alex
Reply to: