Re: bson CVEs in (E)LTS

[Sylvain Beucler <beuc@beuc.net>]

Hi,

On 31/03/2025 16:56, Adrian Bunk wrote:
> On Mon, Mar 31, 2025 at 04:42:59PM +0200, Sylvain Beucler wrote:
> > ...
> > Do we want to update data/embedded-code-copies to reference libbson-xs-perl?
> >
> > e.g.
> > diff --git a/data/embedded-code-copies b/data/embedded-code-copies
> > index 19611b261b..77696af1af 100644
> > --- a/data/embedded-code-copies
> > +++ b/data/embedded-code-copies
> > @@ -3524,9 +3524,9 @@ bootstrap-markdown.js (not packaged in Debian; no ITP)
> >   libjs-chartkick.js
> >          - python-chartkick <unfixed> (embed; bug #836577)
> >
> > -libbson
> > -       - mongo-c-driver <unfixed> (embed)
> > -       NOTE: src:mongo-c-driver builds as well libbson binary package and
> > superseeds src:libbson
> > +mongo-c-driver
> > +       - libbson-xs-perl <unfixed> (embed)
> > +       NOTE: src:mongo-c-driver builds as well libbson binary package and
> > superseeds src:libbson/stretch
> > ...
>
> For ELTS having libbson there would be useful:
>
> mongo-c-driver
>    - libbson <removed> (embed)
>    - libbson-xs-perl <unfixed> (embed)

If the Security Team agrees, let's keep libbson indeed :)

Otherwise, since mongo-c-driver is basically libbson's next (expanded) 
version of the package, and libbson is removed since stretch, I 
referenced it in renamed-packages.elts for tracking:
https://salsa.debian.org/freexian-team/extended-lts/security-tracker/-/commit/c253f47c1b82fc8f40729aaf3cf5b4a8731115b9

(libbson-xs-perl however doesn't fit renamed-packages* and still needs 
to be handled as embedded copy.)

Cheers!
Sylvain