Drop support for libqb?
Hello all,
In recent days I made an attempt at backporting fixes made upstream in
libqb to address CVE-2019-12779. I requested a review from upstream in
the related GitHub issue [0].
The essence of the discussion is that some important parts of the
upstream changes do not apply to the libqb in Jessie, because libqb in
Jessie is considerably older than the releases for which upstream has
provided a fix.
Chris and Brian have both made assessments of the degree of
vulnerability in libqb [1]. The comments from upstream appear to be in
line with those observed by Chris and Brian. That said, Ferenc Wágner,
who is the current maintainer of libqb in Debian and also has
contributed upstream joined the conversation. He asked what packages
depend on libqb. I must confess that it never even occurred to me to
look. The answer is that no packages depend on libqb in Jessie, making
it a leaf package.
Based on that and the vast differences between libqb 0.11.1, in Jessie,
and 1.0.5, in which the fixes have been made available, Ferenc's
assessment, and mine, is that additional effort on this package would be
a waste. From Ferenc's point of view, anybody on such an old release of
Debian would have used 0.17.2 or 1.0.1 from jessie-backports. Neither
of those will be updated by the security team. Updating to a current
upstream release would be low risk from the standpoint of it being a
leaf package, but that does not seem right either.
With that in mind, does this seem like a package for which we should
declare the end of support?
Regards,
-Roberto
[0] https://github.com/ClusterLabs/libqb/issues/338
[1] https://lists.debian.org/debian-lts/2019/06/msg00015.html
--
Roberto C. Sánchez
Reply to: