Re: Bug#933002: docker.io: CVE-2019-13139

[Arnaud Rebillout <arnaud.rebillout@collabora.com>]

  Dear Release Team,

I'm new to the process of uploading to stable, I need your guidance on 
that one.

From the buster announce:

   * The bug you want to fix in stable must be fixed in unstable
     already (and not waiting in NEW or the delayed queue)

My issue with this particular bug (#933002) is that for now, docker.io 
doesn't build in unstable. It will take a while before it builds again, 
as there was changes in the dependency tree.

On the other hand, fixing this bug in stable is just a matter of 
importing the patch from upstream and rebuilding the package.

So how am I supposed to handle that? Waiting for docker.io to be fixed 
and built again in unstable will delay the fix in stable for weeks, I 
don't think it's a good option.

Best regards,

  Arnaud