[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#916642: golang CVE-2019-6486 (DoS in crypto/elliptic)



Hi,

On 1/24/19 3:00 PM, Dr. Tobias Quathamer wrote:
Am 24.01.2019 um 09:12 schrieb Emilio Pozuelo Monfort:
On 24/01/2019 08:58, Michael Stapelberg wrote:
Last time, pochu@ (cc'ed) helpfully scheduled binNMUs. pochu, would you be
able to help this time, too?

Sure. Can you give me a list of source packages to binNMU in unstable? If this
is public already, can you do that through a binNMU bug against release.debian.org?

Emilio

Hi all,

there is already an outdated binNMU list as bug report available, so
I'm reusing that report. Please ignore the previously attached
binNMU list of that bug report.

This should be a complete and current list of needed binNMUs:

[long list of packages]

I've started scheduling these (it will take some time before the script is finished).

Some notes about these binNMUs:

* Some of the packages on the list are binary package names, not sources. I didn't schedule those (they were filtered out by the script I used to schedule the binNMU). I don't have a lot of time right now to check the list of packages, but I already scheduled the source packages on the list, because it will take some time to build those.

* I lowered the priority of all these builds, to avoid blocking the buildds for some time on slower archs.


Some notes about go and the needs for binNMUs in general:

* Please note that there currently is no reasonable way to do something like this for a security issue in stable. This was discusses in this thread: https://lists.debian.org/debian-release/2018/07/msg00002.html

* We (the release team) generally try to rebuild packages with outdated built-using before the release. I'll try to look into doing that in the near future.

Cheers,

Ivo


Reply to: