[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely



Hi Nilesh,

On Sun, 31 Jul 2022, 12:12 Nilesh Patra, <nilesh@debian.org> wrote:
rdflib has been removed from testing along with a bunch of other packages.
And it is triggering -rm-s for packages in testing anyway.

Upstream is not actively working on the issue as I see from the github Issue
URL. -- Do you think we can lower severity of this bug for a bit?

AFAIK, usually it is up to the maintainer to decide about the severity. It could be lowered, yes, but I do not think it is OK to have rdflib with this bug in bookworm. It would be good to ping the upstream as well.

Best,
Andrius

Reply to: