Re: bson CVEs in (E)LTS

[Salvatore Bonaccorso <carnil@debian.org>]

Hi,

On Mon, Mar 31, 2025 at 07:39:55PM +0200, Sylvain Beucler wrote:
> Hi,
> 
> On 31/03/2025 16:56, Adrian Bunk wrote:
> > On Mon, Mar 31, 2025 at 04:42:59PM +0200, Sylvain Beucler wrote:
> > > ...
> > > Do we want to update data/embedded-code-copies to reference libbson-xs-perl?
> > > 
> > > e.g.
> > > diff --git a/data/embedded-code-copies b/data/embedded-code-copies
> > > index 19611b261b..77696af1af 100644
> > > --- a/data/embedded-code-copies
> > > +++ b/data/embedded-code-copies
> > > @@ -3524,9 +3524,9 @@ bootstrap-markdown.js (not packaged in Debian; no ITP)
> > >   libjs-chartkick.js
> > >          - python-chartkick <unfixed> (embed; bug #836577)
> > > 
> > > -libbson
> > > -       - mongo-c-driver <unfixed> (embed)
> > > -       NOTE: src:mongo-c-driver builds as well libbson binary package and
> > > superseeds src:libbson
> > > +mongo-c-driver
> > > +       - libbson-xs-perl <unfixed> (embed)
> > > +       NOTE: src:mongo-c-driver builds as well libbson binary package and
> > > superseeds src:libbson/stretch
> > > ...
> > 
> > For ELTS having libbson there would be useful:
> > 
> > mongo-c-driver
> >    - libbson <removed> (embed)
> >    - libbson-xs-perl <unfixed> (embed)
> 
> If the Security Team agrees, let's keep libbson indeed :)
> 
> Otherwise, since mongo-c-driver is basically libbson's next (expanded)
> version of the package, and libbson is removed since stretch, I referenced
> it in renamed-packages.elts for tracking:
> https://salsa.debian.org/freexian-team/extended-lts/security-tracker/-/commit/c253f47c1b82fc8f40729aaf3cf5b4a8731115b9
> 
> (libbson-xs-perl however doesn't fit renamed-packages* and still needs to be
> handled as embedded copy.)

For now have added the information that libbson-xs-perl embedds
mongo-c-driver.

Regards,
Salvatore