Re: Propose to ignore libxstream-java CVEs

[Anton Gladky <gladk@debian.org>]

Hi Markus,

I have applied your patch and the pipelines are passed [1]. So, at least

nothing breaks from the "build side of view".

Yes, I took this package, but uf your are working on it, feel free to reclaim it.

[1] https://salsa.debian.org/lts-team/packages/libxstream-java/-/pipelines/292916

Best regards

Anton

Am Mi., 22. Sept. 2021 um 15:37 Uhr schrieb Markus Koschany <apo@debian.org>:

Hi all,

so far I have not found any regressions in Debian packages which depend on
libxstream-java. I propose to switch to the whitelist in all suites because
this is the only reasonable way to secure XStream. I have prepared an update
for Stretch. Anton, could you take a look at it because I saw you have claimed
libxstream-java?

https://people.debian.org/~apo/lts/libxstream-java/libxstream-java.debdiff


Regards,

Markus