Re: systemd/247.3-7+deb11u8
Hi,
On 08/04/2026 05:39, Arnaud Rebillout wrote:
I've prepared an update for systemd, two questions:
1) Given that severity of CVE-2026-29111 is higher <= bullseye (stack
overwrite), I suppose I won't wait for the fix to reach bookworm and can
upload straight away (after debusine workflow completes) ?
This is quite rare but yes this makes sense to upload a fix for
CVE-2026-29111 promptly.
Besides debusine, what kind of testing (automated and manual) did you
perform?
Another possibility is to wait for info regarding new CVEs in the
tracker, that just appeared yesterday, and apparently don't have CVE
number yet (they appear in the tracker as TEMP-XXX). And maybe fix those
as well, before uploading.
Apparently this is sorted out now, but maybe we can schedule another DLA
for these later.
Not sure what's best here, wait or not wait, opinions welcome :)
2) If anyone wants to have a look and review, would be nice, given it's
an important package. Pushed at: https://salsa.debian.org/arnaudr/systemd.
There's only a "bookworm-cves" updated branch.
Cheers!
Sylvain
Reply to: