Taking from backports - icingaweb2

[Abhijith PA <abhijith@disroot.org>]

Hello,


Package icingaweb2 (2.4) in stretch have around 9 open CVEs. Most of 
them fixed in upstream v2.6. There isn't isolated patches available 
for CVE-2018-18246 to CVE-2018-18250.

The changes from 2.4 .. 2.6 is pretty large and not much descriptive 
to comb through and cherry pick. I have pinged upstream security team 
to help, unfortunately they couldn't single out the patches. So I was 
wondering whether its ok to upload v2.6 from stretch-backports to 
-security and fix remaining CVEs on top of that.


PS: Its not a priority package for us.

--abhijith