Debian (E)LTS report for May 2025
Hi everyone,
In May I did following LTS work:
Due to a misunderstanding I issued DLA 4167-1 (thunderbird) with quite some
delay, and had some follow-up discussion.
I issued DLA 4183-1 for setuptools, fixing CVE-2025-47273. I also fixed it in
bookworm, and applied for a bookworm-pu. I fixed it in sid with permission of
the maintainer, and applied for a trixie freeze exception. I tried verifying the
fix via the published PoC, however that required some work setting up a
repository to pull from, and since the fix was trivial I did not further pursue
that avenue.
I issued DLA 4190-1 for mydumper, fixing CVE-2025-30224. I also fixed it in
bookworm and applied for a bookworm-pu. Since it FTBFS in sid, I only pushed the
fix to the git packaging repo and left it unreleased, notifying the stable
release managers about it. Since the package was severely out of date, and the
maintainer inactive, I notified the MIA team about the inactive DD. I attempted
to reproduce the security issue by running the vulnerable version against mysql
with the rewriter plugin (only available in sid), and followed the instructions
from the published PoC. I could however not reproduce the issue (it did not
trigger the local file read). Since the issue was present in the unfixed version
from reading the source, I applied the patch anyway. I also added autopkgtests
to verify that no regressions occur.
For ELTS I did the following work:
I fixed CVE-2022-40897, CVE-2024-6345, CVE-2025-47273 in python-setuptools.
Since the patches are only available for python 3, but the package itself is
python 2, backporting the CVE-2024-6345 patch took a bit more time than usual.
As this patch touched many lines of code and the package is a build-dependency
for many other packages, I decided to fix the unit tests (which also test some
of the CVEs) and add them as autopkgtests. I spent some time checking two test
failures that turned out to be broken by previous Debian patches. The package
for buster is complete, I expect backporting the patches and autopkgtests to
jessie and stretch to be less work. I plan on releasing the packages once the
CVEs are fixed in all ELTS releases.
Thanks to our sponsors for financing this work, and to Freexian for coordinating!
Regards,
Lee Garrett,
Debian LTS Team
Reply to: